EX294 Practice Test 1 — 10 Questions

Question 1

Which TWO statements about execution environments are true?

Accepted Answer

Execution environments can include both Ansible and system dependencies.. Option A is correct because an execution environment is an OCI container image that bundles the Ansible Core/ansible-runner runtime together with collections, Python libraries, and system-level dependencies (RPMs, etc.), so it can carry both Ansible and system dependencies. Option E is correct because execution environments are distributed and consumed as OCI container images (e.g., via podman or docker registries), which is the packaging format that makes them portable and reproducible. Option B is wrong because ansible-playbook can be run inside an execution environment (for example, via ansible-navigator or by invoking the container directly), so they are not incompatible. Option C is wrong because ansible-builder is only one tool for creating execution environments; they can also be built with a Containerfile/Dockerfile or other tooling. Option D is wrong because Ansible Navigator is a convenience CLI for running and inspecting execution environments, but it is not required — podman/docker or ansible-runner can use them directly.

Answer

Execution environments cannot be used with ansible-playbook directly.

Answer

Execution environments must be built using ansible-builder.

Answer

Ansible Navigator is required to use execution environments.

Question 2

An administrator is writing a playbook to manage multiple web servers. The playbook uses a variable "server_facts" which is a list of dictionaries with keys "hostname", "ip", and "status". The administrator needs to extract a list of all hostnames where status is "online". The administrator writes:

- name: Get online hosts
  set_fact:
    online_hosts: "{{ server_facts | selectattr('status', '==', 'online') | map(attribute='hostname') | list }}"

However, when running the playbook, the "selectattr" filter fails with an error: "Invalid data passed to filter". The administrator checks the structure of "server_facts" and confirms it is a list of dicts with the expected keys. What is the most likely cause of the error?

Accepted Answer

The "status" key exists but its value is not consistently a string; some entries have integer 0/1 instead of "online"/"offline".. The `selectattr` filter in Ansible uses Jinja2's `selectattr` which relies on Python's `attrgetter` and comparison operators. If the `status` key exists but its value is not consistently a string (e.g., some entries have integer 0/1 instead of 'online'/'offline'), the equality comparison `'==', 'online'` will fail because an integer cannot be compared to a string in this context, causing an 'Invalid data passed to filter' error. The administrator confirmed the structure is correct, so the issue is likely a type mismatch in the values.

Answer

The "map" filter cannot be chained with "selectattr" directly.

Answer

The "list" filter is unnecessary and causes the error.

Answer

The "selectattr" filter requires Python 3.8 or later.

Question 3

An administrator has a requirements.yml file specifying roles from multiple sources: a public Galaxy server, a private Git repository, and a local path. They want to install all roles into the roles directory of the current project. Which command will achieve this?

Accepted Answer

ansible-galaxy install -r requirements.yml --roles-path ./roles. The command 'ansible-galaxy install -r requirements.yml --roles-path ./roles' installs roles from a requirements file into the specified roles directory. The '--roles-path' option (or '-p') sets the destination, and '-r' specifies the requirements file. This meets the requirement to install all roles into the roles directory of the current project.

Answer

ansible-galaxy collection install -r requirements.yml

Answer

ansible-galaxy install -r requirements.yml -p .

Answer

ansible-galaxy role install --force -r requirements.yml

Question 4

An administrator wants to create a custom credential type to store a third-party API key. The API key must be passed to the playbook as an environment variable `MY_API_KEY`. What is the correct Injector configuration in the custom credential type definition?

Accepted Answer

env: {MY_API_KEY: "{{ api_key }}"}. The Injector configuration for a custom credential type in Ansible Automation Platform uses the `env` key to map credential inputs to environment variables. The syntax `env: {"MY_API_KEY": "{{ api_key }}"}` correctly references the input field `api_key` using Jinja2 templating and assigns it to the environment variable `MY_API_KEY`, which the playbook can then access via `ansible_env.MY_API_KEY`.

Answer

file: {MY_API_KEY: "{{ api_key }}"}

Answer

env: {"MY_API_KEY": api_key}

Answer

extra_vars: {MY_API_KEY: "{{ api_key }}"}

Question 5

An Ansible rolling update playbook includes 'max_fail_percentage: 20'. If more than 20% of hosts fail during any batch, what happens?

Accepted Answer

The play aborts immediately. The `max_fail_percentage` parameter in Ansible's rolling update strategy defines the maximum percentage of hosts that can fail in a single batch before the playbook aborts entirely. When the failure rate exceeds this threshold, Ansible stops execution immediately to prevent cascading failures or inconsistent state across the remaining hosts.

Answer

The play pauses and waits for user input

Answer

The failed hosts are removed from inventory

Answer

The play retries failed hosts

Answer

The play continues with remaining hosts

Question 6

A playbook uses 'vars_prompt' to ask for a confirmation before proceeding with destructive changes. However, when the playbook is run from a CI/CD pipeline, it hangs indefinitely. What is the best way to handle this?

Accepted Answer

Pass the variable via --extra-vars and modify the prompt to be conditional with 'when: variable is not defined'.. Passing the variable via --extra-vars and making the prompt conditional with 'when: variable is not defined' allows the pipeline to provide the variable non-interactively. Option A is unsafe. Option B's --check mode does not solve prompts. Option C is unrelated. Option D encrypts data but does not handle prompts. Therefore, E is best.

Answer

Remove the prompt and always proceed.

Answer

Set ANSIBLE_STDOUT_CALLBACK=unixy to avoid interactive prompts.

Answer

Encrypt the confirmation in vault and include it.

Answer

Use --check mode to simulate.

Question 7

An Ansible playbook uses the "community.general" collection to manage firewall rules. The engineer wants to use a lookup plugin to fetch the current IPv4 address of a host to include in a dynamic inventory script. Which TWO of the following options correctly describe the usage of lookup plugins in Ansible?

Accepted Answer

Lookup plugins are executed on the control node and return data to the Ansible controller.. Lookup plugins in Ansible are designed to run on the control node (the machine where Ansible is executed), not on the remote host. They fetch data from external sources (e.g., files, databases, environment variables) and return that data to the Ansible controller for use in playbooks or inventory scripts. This aligns with the requirement to fetch the current IPv4 address of a host for a dynamic inventory script, as the lookup plugin can query local or network sources without needing to execute on the target host.

Answer

Lookup plugins are always executed on the remote host.

Answer

Lookup plugins must be imported using the "lookup" keyword.

Answer

The "file" lookup plugin reads the content of a file from the remote host.

Question 8

Which best practice should be followed when using Ansible to manage task execution across multiple hosts?

Accepted Answer

Ensure tasks are idempotent so they can be run multiple times without changing the system state beyond the desired state.. Idempotency is a core principle of Ansible: running the same playbook multiple times should produce the same desired state without unintended side effects. This ensures predictable, safe task execution across multiple hosts, as Ansible modules are designed to check the current state before making changes.

Answer

Use 'ignore_errors: yes' on all tasks to prevent playbook failures.

Answer

Always use serial execution to avoid race conditions.

Answer

Write tasks that rely on the previous task's output to ensure correct order.

Question 9

An administrator wants to ensure a role's tasks are executed only on certain hosts. Which approach should they use?

Accepted Answer

Use a 'when' condition in the role's tasks. Ansible's 'when' clause allows conditional execution of tasks based on variables such as inventory hostname, group membership, or custom facts. By using a 'when' condition that checks the target host's identity (e.g., 'ansible_hostname' or 'inventory_hostname'), the administrator can ensure that the role's tasks run only on specific hosts, without modifying inventory structure or using separate variable files.

Answer

Set host_vars for each target host

Answer

Set group_vars for the target group

Answer

Use tags on the role

Question 10

An Ansible playbook uses a rolling update strategy with serial: 1. After the first host is updated, the playbook stops and shows 'PLAY RECAP' with only one host. What is the most likely reason?

Accepted Answer

the inventory contains only one host. The `serial: 1` directive in Ansible limits concurrency to one host at a time, but the playbook will still process all hosts in the inventory. If the playbook stops after the first host and shows PLAY RECAP with only one host, the most likely reason is that the inventory contains only one host. With a single host, the play executes on that host and then finishes. Option B accurately identifies this scenario.

Answer

the playbook has a 'failed_when' condition that stops execution

Answer

the play uses 'delegate_to' incorrectly

Answer

the playbook does not have any task that triggers the next batch, and 'serial' only controls concurrency, not retry