EX294 Practice Test 2 — 10 Questions

Question 1

Refer to the exhibit. A playbook fails with the given error. What is the most likely cause?

Accepted Answer

The vault password file is missing or incorrect.. The error indicates that Ansible cannot locate vault secrets. This typically happens when the vault password file is missing or incorrect. Options B, C, and D produce different error messages.

Answer

The playbook syntax is wrong.

Answer

The inventory file is encrypted.

Answer

The remote host is unreachable.

Question 2

An organization uses a proprietary API service that requires token-based authentication with a base64-encoded payload including username, password, and tenant ID. The administrator wants to create a custom credential type in automation controller so that users can input these three values separately, and the playbook receives the final token. Which input configuration fields should be defined?

Accepted Answer

Three separate text fields (username, password, tenant ID) with a custom injector template that concatenates and base64-encodes them.. Custom credential types allow multiple inputs and an injector template to transform them. Option B allows users to input each component separately and the injector creates the base64 token. Option A only stores the token. Option C misses tenant ID. Option D is not user-friendly.

Answer

One text field for the token, and inject it as an environment variable.

Answer

Two fields: username and password, and use a lookup plugin to fetch tenant ID.

Answer

Create a single multiline text field where users paste the base64 string.

Question 3

An Ansible automation team is designing a playbook to manage network devices. They need to ensure that the playbook can handle transient network failures by retrying failed tasks a specific number of times with a delay between retries. Which approach should they use?

Accepted Answer

Use the `until` loop with `retries` and `delay` parameters on the task.. The `until` loop with `retries` and `delay` parameters is the correct approach because it allows a task to be retried a specified number of times with a configurable pause between attempts, directly addressing transient network failures. This is a built-in Ansible feature for handling intermittent issues without additional error-handling constructs.

Answer

Set `max_fail_percentage` in the play to 0 and use `ignore_errors: yes` with a rescue block.

Answer

Use the `throttle` keyword to limit concurrent tasks and rely on idempotency.

Answer

Set `serial: 1` on the play to ensure only one host is processed at a time and rely on idempotency.

Question 4

A systems administrator needs to run a playbook that applies configuration changes to a set of servers. They want to ensure that if any task fails on a host, the playbook continues with the next host without aborting the entire play. Which play-level keyword should they use?

Accepted Answer

`ignore_errors: yes` on each task that might fail.. Option D is correct because `ignore_errors: yes` on each task ensures that if a task fails on a host, the playbook continues executing subsequent tasks on that host and moves on to the next host without aborting the entire play. This directly meets the requirement to continue with the next host upon task failure.

Answer

Set `gather_facts: no` to skip fact gathering and reduce failure points.

Answer

Set `any_errors_fatal: true` at the play level.

Answer

Set `force_handlers: true` at the play level.

Question 5

An automation controller administrator must ensure that a playbook's output does not expose sensitive data. Which TWO actions should be taken? (Choose exactly two.)

Accepted Answer

Set 'no_log: true' on tasks that handle sensitive data.. Setting 'no_log: true' on tasks that handle sensitive data (Option A) is the correct approach because it prevents Ansible from printing task arguments and output to the console or log files, ensuring that sensitive information like passwords or API keys are not exposed. This directive is a built-in Ansible feature specifically designed for security-sensitive operations.

Answer

Set 'stdout_callback = actionable' in ansible.cfg.

Answer

Use 'name: "Sensitive task"' but keep the task body visible.

Answer

Use 'tags: never' on sensitive tasks.

Question 6

An organization requires that all Ansible playbooks be executed using a specific service account that has limited permissions. The account can only run playbooks from a specific directory. Which approach best enforces this requirement in automation controller?

Accepted Answer

Create a project that syncs only the authorized directory, and assign the service account as the only user with execute permissions on that project.. Option C is correct because Automation Controller (formerly Ansible Tower) uses Projects to manage playbook source code. By creating a Project that syncs only the authorized directory and assigning the service account as the only user with execute permissions on that Project, you restrict the service account to running playbooks exclusively from that directory. This enforces the requirement at the platform level, leveraging role-based access control (RBAC) within the controller.

Answer

Use an inventory that contains only the allowed hosts.

Answer

Configure an execution environment that mounts the authorized directory as read-only.

Answer

Assign the service account a machine credential that connects to the controller via SSH.

Question 7

An Ansible automation controller job template uses a custom credential type that requires a secret token. The token is stored as an extra variable in the job template definition. A security audit reveals the token is visible in plaintext in the job output. Which action should the administrator take to secure the secret?

Accepted Answer

Define the variable in the job template's 'extra variables' field with 'no_log: true' set in the playbook for that variable.. Option A is correct because setting `no_log: true` on the variable in the playbook prevents Ansible from printing the value of that variable in any output, including job logs. This is the standard method to hide sensitive data like tokens when they are passed as extra variables, as it works at the task level to suppress logging of the variable's content.

Answer

Vault-encrypt the variable in the playbook and reference it with {{ vault_var }}.

Answer

Create a custom credential type that injects the token as an environment variable, and remove the extra variable from the job template.

Answer

Store the token in a file on the controller with 600 permissions and use 'lookup' in the playbook.

Question 8

A Red Hat Ansible Automation Platform deployment uses automation mesh to manage remote nodes across a high-latency WAN. An administrator notices that some job runs fail intermittently due to connection timeouts. The administrator wants to improve reliability without changing network infrastructure. Which configuration change is most effective?

Accepted Answer

Increase the 'timeout' value in the [defaults] section of ansible.cfg to 60 seconds.. Option A is correct because increasing the 'timeout' value in the [defaults] section of ansible.cfg extends the SSH connection timeout, which directly addresses intermittent failures caused by high-latency WAN links. This change allows Ansible to wait longer for a remote node to respond before aborting the connection, improving reliability without altering network infrastructure.

Answer

Increase the 'retries' parameter for each task.

Answer

Increase the 'forks' value in ansible.cfg to 50.

Answer

Set 'async: 600' and 'poll: 10' in the playbook.

Question 9

A managed node is not responding to Ansible automation. The administrator verifies that the node is reachable via SSH and that the SSH key is correctly deployed. However, 'ansible all -m ping' fails with 'UNREACHABLE'. The automation controller uses a custom execution environment. What is the most likely cause?

Accepted Answer

The custom execution environment is missing the 'python3' or 'python' package.. Option C is correct because the custom execution environment is a container image that must contain the Python interpreter (python3 or python) for Ansible to execute modules on the managed node. When the environment lacks Python, the 'ansible -m ping' module cannot be transferred and executed, resulting in an 'UNREACHABLE' status despite SSH connectivity being verified.

Answer

The SSH private key has incorrect permissions on the controller.

Answer

The remote user specified in the credential does not have sudo access.

Answer

The automation controller is behind a firewall that blocks SSH.

Question 10

Which TWO of the following are best practices when coordinating rolling updates with Ansible?

Accepted Answer

Define a 'max_fail_percentage' to abort the update if too many hosts fail.. Option A is correct because 'max_fail_percentage' allows you to define a threshold of host failures (as a percentage of the batch size) that, when exceeded, causes Ansible to abort the entire rolling update. This prevents the update from continuing when too many hosts have failed, which could lead to an inconsistent or degraded state across the infrastructure. Option B is correct because the 'serial' keyword controls the number of hosts (or percentage) that Ansible updates in each batch, ensuring that only a subset of hosts is taken out of service at a time, which maintains overall service availability during the rolling update.

Answer

Use 'strategy: free' to allow hosts to run tasks independently.

Answer

Use 'gather_facts: no' to speed up the playbook.

Answer

Set 'any_errors_fatal: true' to stop the update on the first failure.

EX294 Practice Test 2 — 10 Questions

Exhibit

EX294 Practice Test 2 — 10 Questions

Exhibit