EX294 Practice Test 11 — 15 Questions

Question 1

Your team uses ansible-pull to manage configuration of a large number of remote nodes. Each node is configured to pull the latest playbook from a Git repository every 30 minutes. Recently, some nodes started reporting 'ERROR! the role 'base' was not found'. The playbook depends on roles from a requirements.yml file that is stored in the same repository. The ansible-pull command on each node uses the default roles path (~/.ansible/roles). The Git repository contains the requirements.yml file but does not contain the actual role directories. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a pre_task to the playbook that runs 'ansible-galaxy install -r requirements.yml' before the roles are used.. Ansible-pull does not automatically install roles from requirements.yml; the playbook should include a pre_task that runs 'ansible-galaxy install -r requirements.yml' before using the roles. Option A is incorrect because the roles are already in the repository? No, they are not. Option B is incorrect because ansible-pull does not use a local roles path by default; the issue is missing installation. Option D is incorrect because the control node is not involved in ansible-pull.

Answer

Run ansible-galaxy install on the control node and distribute the roles via a separate channel.

Answer

Add the role directories directly to the Git repository and modify the playbook to reference them with a relative path.

Answer

Set the 'roles_path' in ansible.cfg on each node to include the repository's roles directory.

Question 2

An Ansible playbook uses a vault-encrypted variable `db_password` from a vars file. The playbook fails with 'Decryption failed' error. Which of the following could be the cause?

Accepted Answer

The vault ID in the encrypted file does not match the provided vault ID.. Ansible Vault supports multiple vault IDs, and the vault ID used to encrypt the variable must match the vault ID provided at runtime (via `--vault-id` or `ansible.cfg`). If the encrypted file was created with vault ID 'prod' but the playbook is run with vault ID 'dev', Ansible will fail with 'Decryption failed' because it cannot find a matching password for that ID.

Answer

The vault password is correct but the file is corrupted.

Answer

The vault password file path is incorrect in ansible.cfg.

Answer

The variable is not encrypted but marked as `!vault`.

Question 3

A developer wants to create a new Ansible collection from a skeleton template. Which command should be used?

Accepted Answer

`ansible-galaxy collection init my_namespace.my_collection`. The correct command is `ansible-galaxy collection init my_namespace.my_collection`, which creates a new collection skeleton with the required directory structure and metadata files. This is the official Ansible command for bootstrapping a collection from a template.

Answer

`ansible-galaxy collection generate my_namespace.my_collection`

Answer

`ansible-galaxy collection create my_namespace.my_collection`

Answer

`ansible-galaxy collection start my_namespace.my_collection`

Question 4

An operations team is planning a rolling update of a production OpenShift cluster running Red Hat Enterprise Linux CoreOS nodes. Which three practices should be followed to ensure minimal downtime and proper rollback capability?

Accepted Answer

Use canary nodes to validate the update before full rollout.. Using canary nodes allows you to validate the update on a small subset of nodes before rolling it out to the entire cluster. This practice minimizes the blast radius of potential issues, ensuring that if the update causes problems, only the canary nodes are affected, and the rest of the cluster remains stable. It directly supports minimal downtime by catching failures early and provides a clear rollback point by isolating the test group.

Answer

Monitor cluster health via `oc get clusterversion` after each node update.

Answer

Place nodes in the same Availability Zone to simplify rollback.

Question 5

Which TWO statements about machine credentials in Ansible Tower are correct? (Choose two.)

Accepted Answer

Machine credentials can specify a 'become_method' for privilege escalation.. Ansible Tower machine credentials include a 'Become Method' field that allows you to specify privilege escalation methods such as 'sudo', 'su', 'pbrun', or 'pfexec'. This setting is used by Ansible to escalate privileges on the target machine after the initial SSH connection is established, enabling tasks that require higher-level permissions.

Answer

The SSH private key file automatically includes privilege escalation settings.

Answer

The username field is optional when using an SSH key.

Answer

SSH key credentials require a password field to be filled in.

Question 6

A team uses Ansible to update a database cluster with one primary and two replicas. The goal is zero downtime. Which update order is the safest?

Accepted Answer

Update replicas first, then the primary.. Updating replicas first ensures that if the update introduces a regression, it affects only the read-only replicas, which can be quickly rolled back without impacting write availability. Once replicas are confirmed healthy, the primary is updated and a controlled failover (e.g., using `patronictl switchover` or `repmgr standby switchover`) promotes a replica to primary, minimizing downtime to seconds. This order aligns with the principle of reducing blast radius and maintaining quorum in a cluster.

Answer

Update in random order.

Answer

Update all nodes simultaneously.

Answer

Update the primary first, then replicas.

Question 7

A user wants to run a playbook that uses a module from 'myorg.mycollection'. The playbook is located in /home/user/projects. Which of the following is true about the collection discovery?

Accepted Answer

Ansible will automatically find the collection in the default search path.. Ansible automatically searches for collections in the default search path, which includes the collections directory adjacent to the playbook. Since the playbook is located in /home/user/projects, Ansible will look in /home/user/projects/collections/ansible_collections/myorg/mycollection, among other default paths, without requiring any environment variable or manual configuration.

Answer

The user must set the ANSIBLE_COLLECTIONS_PATH environment variable.

Answer

The collection is not installed, so the playbook will fail.

Answer

Ansible will look only in /usr/share/ansible/collections.

Question 8

An Ansible role has tasks that need to run in a specific order, and some tasks must use a different shell interpreter. Which feature allows the role to control task execution order and environment settings?

Accepted Answer

Use the block directive to order tasks and a vars file for interpreter.. The block directive groups tasks that run in the order they appear, allowing control over task execution order within a role. Environment settings, such as a different shell interpreter, can be achieved using a vars file to define variables like ansible_shell_executable, which applies to tasks in the block. Option A is incorrect because the meta module (ansible.builtin.meta) does not declare role dependencies; role dependencies are defined in meta/main.yml. Options B and C are incorrect as strategy plugins and tags do not directly control task order or interpreter settings.

Answer

Use the meta module to declare dependencies and the environment directive in tasks.

Answer

Use the strategy plugin and a custom lookup to set interpreter.

Answer

Use tags to control execution order and a custom inventory script.

Question 9

Refer to the exhibit. The administrator wants to run a playbook that installs a package on all webservers. Which command will use the existing configuration and inventory correctly?

Accepted Answer

ansible-playbook site.yml. The ansible.cfg sets inventory=./inventory and roles_path=./roles. The playbook should be run with ansible-playbook, which reads the configuration automatically. The -i flag is not needed because inventory is defined in ansible.cfg.

Answer

ansible-playbook -e 'ansible_python_interpreter=/usr/bin/python3' site.yml

Answer

ansible webservers -m package -a 'name=httpd state=present'

Answer

ansible-playbook -i inventory site.yml

Question 10

An operations team is designing a rolling update for a stateful application that requires quorum (minimum 3 out of 5 nodes online). They plan to use Ansible's serial keyword. Which serial value ensures the update proceeds without breaking quorum while still being efficient?

Accepted Answer

serial: 2. Setting serial: 2 ensures that only 2 nodes are taken down at a time during the rolling update. With a quorum requirement of 3 out of 5 nodes, taking down 2 nodes leaves 3 online, maintaining quorum. This is the most efficient value that does not risk breaking quorum.

Answer

serial: 1

Answer

serial: 3

Answer

serial: 5

Question 11

Refer to the exhibit. The administrator notices that the handler 'restart httpd' runs even though the httpd service was already running. Which change would ensure the handler only runs if the service configuration changes?

Accepted Answer

Use a separate handler for configuration changes and notify it from tasks that modify configuration files.. The handler is notified by the 'Install httpd' task, which changes only on initial installation or update. However, the handler runs after the 'Ensure httpd is running' task, which is unnecessary. To avoid restarting when the service is already running and no configuration changed, the administrator should add a 'listen' directive or use a separate handler for configuration changes.

Answer

Add a condition to the handler to check if httpd is already running.

Answer

Set the handler to 'state: reloaded' instead of 'restarted'.

Answer

Move the 'Ensure httpd is running' task before the handler notification.

Question 12

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 13

A systems administrator at a growing company uses Red Hat Ansible Automation Platform to manage configuration of web servers. They have a job template named 'Web Server Config' that runs a playbook to apply security hardening. The playbook includes variables encrypted with Ansible Vault using the default vault ID. The administrator has created a credential of type 'Ansible Vault Password' in Automation Controller and assigned it to the job template. When the job runs, it fails with the error: 'Decryption failed (no vault secrets would be found that would decrypt)'. However, other job templates that use the same vault credential run successfully. The administrator checks that the vault password is correct and that the credential is properly assigned. They also verify that the playbook's path is correct and the inventory is populated. What is the most likely cause of the failure?

Accepted Answer

The playbook references a different vault id than the one in the credential.. Since other job templates with the same credential succeed, the credential is valid and assigned. The error 'no vault secrets would be found' typically occurs when the playbook references a vault id that was not provided. The most likely cause is a vault id mismatch between the playbook and the credential.

Answer

The playbook has a syntax error.

Answer

The vault password file is missing from the controller.

Answer

The vault credential is not assigned to this specific job template.

Question 14

A system administrator wants to build an Ansible execution environment using ansible-builder. Which file format is required to define the base image, dependencies, and additional Python packages for the build?

Accepted Answer

execution-environment.yml. `ansible-builder` requires an `execution-environment.yml` file to define the build context, including the base image (under `version: 1`), system-level dependencies (under `dependencies: system:`), and additional Python packages (under `dependencies: python:`). This file is the mandatory definition file for building an Ansible Execution Environment (EE) using `ansible-builder build`.

Answer

ansible-navigator.yml

Answer

Containerfile

Answer

requirements.yml

Question 15

An Ansible playbook uses the 'block' and 'rescue' directives. Which two statements are true about this construct? (Choose two.)

Accepted Answer

A rescue section executes only if the block tasks fail.. The 'rescue' section in an Ansible block is specifically designed to execute only when a task within the 'block' fails. This allows you to define error recovery or rollback steps that run only on hosts where the block encountered a failure, ensuring that successful hosts are not affected by rescue logic.

Answer

Rescue tasks are executed on all hosts in the play.

Answer

Blocks cannot be nested.

Answer

A block can have multiple rescue sections.