EX294 Practice Test 11 — 15 Questions

Question 1

A playbook needs to load encrypted variables from a file vault.yml. The vault password is stored in a file vault-pass with restricted permissions. Which method securely loads the variables when running the playbook?

Accepted Answer

Run ansible-playbook playbook.yml --vault-password-file vault-pass. Option C is correct because running ansible-playbook with --vault-password-file specifies the file containing the vault password, which is a best practice. Option A would fail because the encrypted file cannot be read without the vault password. Option B prompts for the password, which is less secure in automation. Option D sets an environment variable, which could be insecure if the session is shared.

Answer

Use include_vars: file: vault.yml without any additional configuration.

Answer

Run ansible-playbook with --ask-vault-pass to prompt for the password.

Answer

Set the environment variable ANSIBLE_VAULT_PASSWORD_FILE in the user's profile.

Question 2

Which TWO elements can be used to include external task files in a playbook?

Accepted Answer

import_tasks. import_tasks and include_tasks are the two directives to include external task files. import_tasks is static and processed at parse time, while include_tasks is dynamic and processed at runtime.

Answer

include_vars

Answer

add_host

Answer

include_role

Question 3

A team develops a custom Ansible role 'webserver' that depends on another role 'common'. They want to ensure that when 'webserver' is used, 'common' is automatically installed from the same Galaxy server. Which approach should they use?

Accepted Answer

Add a dependencies: ['common'] to the role's meta/main.yml file.. Option A is correct because role dependencies are declared in the meta/main.yml file using the 'dependencies' key, which causes ansible-galaxy to automatically install dependent roles. Option B relies on a requirements.yml file, which is not automatically processed when using the role. Option C requires manual intervention. Option D works but does not automate installation of the dependency.

Answer

Add a requirements.yml file in the role's root directory specifying common.

Answer

Use ansible-galaxy install webserver --with-dependencies to install common separately.

Answer

Include the 'common' role in the playbook before 'webserver'.

Question 4

An administrator wants to define role dependencies. In which file should they place the dependencies declaration?

Accepted Answer

meta/main.yml. Role dependencies are defined in the meta/main.yml file using the 'dependencies' keyword. This file holds metadata about the role, including dependencies, author, etc.

Answer

vars/main.yml

Answer

defaults/main.yml

Answer

tasks/main.yml

Question 5

Refer to the exhibit. An Ansible playbook task fails with 'Missing sudo password'. The playbook runs against a server where the remote user 'admin' has sudo privileges but requires a password. Which configuration change would resolve this issue?

Accepted Answer

Set ansible_become_password or use the -K flag when running the playbook.. Option B is correct because the error indicates that sudo requires a password and Ansible does not have it. Setting ansible_become_password provides the password. Option A is incorrect because the become_user is valid. Option C is incorrect because the user does have sudo privileges but requires a password. Option D is incorrect because changing to 'su' would use a different authentication method and is unnecessary.

Answer

Change become_method to su to avoid password prompts.

Answer

Remove the become_user line and rely on default root.

Answer

Change become_user to root.

Question 6

An Ansible playbook that installs packages and configures services is not idempotent. Which two practices should be implemented to make it idempotent? (Choose two.)

Accepted Answer

Use the command module with the 'creates' parameter.. Options A and B are correct. Using state=present for package installation ensures the package is installed only if not present, making it idempotent. Using the command module with the 'creates' parameter ensures the command runs only if the specified file does not exist. Options C, D, and E do not directly address idempotency.

Answer

Use notify handlers to restart services only on change.

Answer

Use check_mode: yes to preview changes.

Answer

Set always_run: yes on tasks.

Question 7

An administrator has a playbook with tasks tagged 'install', 'configure', and 'service'. There are no untagged tasks. They want to run only the tasks tagged 'install' and 'configure', skipping 'service'. Which three commands will achieve this? (Choose three.)

Accepted Answer

ansible-playbook site.yml --tags install,configure. Options A, B, and C are correct. A uses --tags with both tags. B uses separate --tags options which accumulate. C uses --skip-tags to exclude service, which works because there are no untagged tasks. D and E are incorrect because they include only one tag or exclude the wrong tags.

Answer

ansible-playbook site.yml --tags configure --skip-tags install,service

Answer

ansible-playbook site.yml --tags install --skip-tags service

Question 8

Your team uses ansible-pull to manage configuration of a large number of remote nodes. Each node is configured to pull the latest playbook from a Git repository every 30 minutes. Recently, some nodes started reporting 'ERROR! the role 'base' was not found'. The playbook depends on roles from a requirements.yml file that is stored in the same repository. The ansible-pull command on each node uses the default roles path (~/.ansible/roles). The Git repository contains the requirements.yml file but does not contain the actual role directories. What is the most likely cause and solution?

Accepted Answer

Add a pre_task to the playbook that runs 'ansible-galaxy install -r requirements.yml' before the roles are used.. Option C is correct because ansible-pull does not automatically install roles from requirements.yml; the playbook should include a pre_task that runs 'ansible-galaxy install -r requirements.yml' before using the roles. Option A is incorrect because the roles are already in the repository? No, they are not. Option B is incorrect because ansible-pull does not use a local roles path by default; the issue is missing installation. Option D is incorrect because the control node is not involved in ansible-pull.

Answer

Run ansible-galaxy install on the control node and distribute the roles via a separate channel.

Answer

Add the role directories directly to the Git repository and modify the playbook to reference them with a relative path.

Answer

Set the 'roles_path' in ansible.cfg on each node to include the repository's roles directory.

Question 9

Which TWO statements about Ansible Execution Environments (EE) are true?

Accepted Answer

Execution environments are container images built with ansible-builder.. Option C is correct because execution environments are container images that package Ansible Core, collections, and Python dependencies, and they are built using the `ansible-builder` tool. The `ansible-builder` reads a definition file (e.g., `execution-environment.yml`) to construct a container image that includes all necessary components for running Ansible automation in a consistent, isolated environment.

Answer

Execution environments are primarily used for developing new Ansible modules.

Answer

Execution environments use ansible-navigator as the default entrypoint.

Answer

Execution environments can only be used with the ansible-navigator command-line tool.

Question 10

An operations team is designing a rolling update for a stateful application that requires quorum (minimum 3 out of 5 nodes online). They plan to use Ansible's serial keyword. Which serial value ensures the update proceeds without breaking quorum while still being efficient?

Accepted Answer

serial: 2. Option A is correct because setting serial: 2 ensures that only 2 nodes are taken down at a time during the rolling update. With a quorum requirement of 3 out of 5 nodes, taking down 2 nodes leaves 3 online, maintaining quorum. This is the most efficient value that does not risk breaking quorum.

Answer

serial: 1

Answer

serial: 3

Answer

serial: 5

Question 11

Which TWO options are best practices for coordinating rolling updates with Ansible? (Choose exactly two.)

Accepted Answer

Use the serial keyword to update hosts in batches.. Option B is correct because the `serial` keyword in Ansible controls how many hosts are updated at a time during a rolling update, allowing you to update hosts in batches to maintain service availability. This is a best practice for coordinating rolling updates as it prevents overwhelming the infrastructure and ensures that a subset of hosts remains operational while others are being updated.

Answer

Set ignore_errors: yes to ensure the playbook continues even if some hosts fail.

Answer

Use the default serial setting (all hosts) for simplicity.

Answer

Run all hosts in parallel to minimize total update time.

Question 12

A systems administrator is deploying Ansible Automation Platform 2.4 using the provided setup script. The installation fails with the error shown in the exhibit. Based on the exhibit, what is the most likely cause of the failure?

Accepted Answer

The PostgreSQL service is not running on the database server.. The error exhibit indicates that the installer cannot connect to the PostgreSQL database. The most common cause of this failure is that the PostgreSQL service is not running on the database server, preventing the Ansible Automation Platform setup script from establishing a connection. Without the database service active, the installer cannot proceed with the deployment.

Answer

The installer requires a local PostgreSQL database; using a remote database is not supported.

Answer

The database password specified in setup.sh does not match the actual PostgreSQL password.

Answer

SELinux is blocking the ansible-navigator process from reaching the database.

Question 13

An Ansible playbook uses the `ansible_password` variable to connect to a Windows host. The value is stored in an encrypted Ansible Vault file. Which credential type in Automation Controller would allow the vault password to be supplied at runtime?

Accepted Answer

Vault credential. Option C is correct because Automation Controller's Vault credential type is specifically designed to provide the vault password needed to decrypt Ansible Vault-encrypted variables like `ansible_password`. When a job runs, the controller uses this credential to unlock the vault file, allowing the playbook to access the encrypted value at runtime without exposing the plaintext password.

Answer

Cloud credential

Answer

Machine credential

Answer

Network credential

Question 14

Which THREE of the following are best practices for managing credentials in Ansible Automation Controller?

Accepted Answer

Restrict credential 'Use' permissions to specific users or teams. Option C is correct because Ansible Automation Controller's Role-Based Access Control (RBAC) allows administrators to assign granular 'Use' permissions to specific users or teams, ensuring that only authorized entities can leverage a credential for job runs. This prevents unauthorized access to sensitive secrets and aligns with the principle of least privilege, which is a core security best practice in automation environments.

Answer

Avoid using external secret management systems; keep all secrets in Automation Controller

Answer

Share the same credential across multiple organizations for simplicity

Question 15

An Ansible playbook is designed to run on a group of database servers. The administrator wants to ensure that a task runs only on the primary database server, which is defined in the inventory with a variable 'primary: true'. Which conditional should be used?

Accepted Answer

when: primary. Option B is correct because the `when` conditional in Ansible evaluates a Jinja2 expression to determine whether a task should execute. By using `when: primary`, the task will run only on hosts where the inventory variable `primary` is defined and evaluates to `true` (a truthy value). This directly meets the requirement to target the primary database server.

Answer

ignore_errors: yes

Answer

run_once: true

Answer

delegate_to: "{{ primary }}"