EX294 Practice Test 12 — 15 Questions

Question 1

Your organization uses Ansible Automation Platform 2.2 with private Automation Hub. You have developed a custom collection named 'my_company.network' that depends on 'cisco.ios' and 'vyos.vyos'. The collection is published in your private hub. You are building an execution environment using ansible-builder. The execution-environment.yml specifies 'EE_BASE_IMAGE: registry.redhat.io/ansible-automation-platform-22/ee-supported-rhel8:latest'. The dependencies section points to a requirements.yml file that includes your collection. When you run 'ansible-builder build', the build succeeds, but when running a playbook that uses modules from 'cisco.ios', you get an error 'module not found'. What is the most likely reason and the correct action to resolve it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add 'cisco.ios' to the requirements.yml file used during the execution environment build. The execution environment build process uses the requirements.yml file to determine which collections to include in the image. If the custom collection 'my_company.network' depends on 'cisco.ios', but that dependency is not explicitly listed in the requirements.yml, the builder will not include 'cisco.ios' in the execution environment. Adding 'cisco.ios' to the requirements.yml ensures it is installed during the build, making the module available at runtime.

Answer

Reinstall the collection on the controller node using 'ansible-galaxy collection install'

Answer

Use a different base image that includes 'cisco.ios'

Answer

Update the collection metadata to include dependencies and rebuild

Question 2

You are maintaining an Ansible automation for a large Red Hat Enterprise Linux deployment. The playbook configures NTP servers on all managed nodes. It uses a variable 'ntp_servers' defined in group_vars/all.yml as a list: ['0.rhel.pool.ntp.org', '1.rhel.pool.ntp.org', '2.rhel.pool.ntp.org']. The playbook task uses the 'uri' module to test connectivity to each server, but only if the server is reachable. The task currently uses:

```
- name: Test NTP server reachability
  uri:
    url: "http://{{ item }}:123"
    timeout: 5
  register: result
  loop: "{{ ntp_servers }}"
  until: result.status == 200
  retries: 3
  delay: 2
```

However, the playbook fails because the NTP servers do not respond to HTTP on port 123. You need to change the approach to test ICMP reachability using the 'ping' module, but the 'ping' module does not support a custom destination port. You also want to continue using a loop and register the success/failure per server. Which of the following is the best course of action?

Accepted Answer

Replace the task with the 'command' module to run 'ping -c 1 {{ item }}' and register results, using 'ignore_errors' to handle unreachable servers.. The 'ping' module in Ansible does not support custom ports or protocols, and NTP servers do not respond to HTTP on port 123. Using the 'command' module to run 'ping -c 1' allows ICMP reachability testing, and 'ignore_errors' prevents playbook failure when a server is unreachable, while still registering per-server success/failure via the loop.

Answer

Use the 'slurp' module to read the /etc/hosts file and check if the server is listed.

Answer

Use the 'wait_for' module with 'host={{ item }}' and 'port=123' to test connectivity, since NTP uses UDP 123.

Answer

Use the 'ping' module with a loop over the ntp_servers list, setting the 'data' parameter to the server IP.

Question 3

You are a Red Hat Certified Engineer tasked with creating a content collection for your organization. The collection will contain roles and modules used by multiple teams. The requirements are: (1) The collection must follow the Ansible community structure. (2) It must include a module that manages network devices. (3) The collection must be versioned and published to Automation Hub. (4) You must provide a minimal working example for other developers. After initial development, you run 'ansible-galaxy collection build' and it fails with 'ERROR! Unknown file type in collection: .gitkeep'. The collection directory contains:

- galaxy.yml
- plugins/modules/network_config.py
- roles/network/
- tests/
- .gitkeep (in tests/)

What single action should you take to resolve the build error?

Accepted Answer

Remove the .gitkeep file from the collection.. The `ansible-galaxy collection build` command fails because it encounters a `.gitkeep` file inside the `tests/` directory, which is not a recognized file type for Ansible collections. The correct action is to remove the `.gitkeep` file, as Ansible collections only allow specific file types (e.g., `.yml`, `.yaml`, `.py`, `.rst`, `.md`, `.txt`, `.cfg`, `.json`, `.j2`, `.ps1`, `.psm1`, `.psd1`, `.csv`, `.env`, `.gitignore`, `.galaxy_ignore.yml`, and a few others). The `.gitkeep` file is not in this allowed list, causing the build to abort.

Answer

Add a 'namespace' field to galaxy.yml.

Answer

Create a .galaxy_ignore.yml file to exclude .gitkeep.

Answer

Move the network_config.py module to a subdirectory named 'modules'.

Question 4

Which THREE considerations are important when designing a credential strategy in Ansible Automation Platform? (Choose exactly three.)

Accepted Answer

Credentials should be assigned to job templates rather than embedded in playbooks. Ansible Automation Platform (AAP) best practices dictate that credentials should be assigned to job templates, not embedded in playbooks. This decouples sensitive authentication data from automation logic, allowing credentials to be managed, rotated, and audited centrally through the AAP controller without exposing them in version-controlled playbook files.

Answer

All credentials must be stored within the AAP database for security

Answer

Playbooks should contain hardcoded credentials for simplicity

Question 5

The playbook above fails with 'template source file not found' for the copy task. Which change should be made to fix it?

Accepted Answer

Use the 'template' module instead of 'copy' for .j2 files.. The 'copy' module does not render Jinja2 templates; it simply copies files as is. When using a .j2 file with the copy module, Ansible expects the source file to exist literally, but it looks for the template in the wrong location, causing the 'template source file not found' error. The 'template' module is designed to process .j2 files, applying variables and Jinja2 logic, and then copying the result to the remote host. Therefore, replacing 'copy' with 'template' resolves the issue.

Answer

Add 'delegate_to: localhost' to copy the file from the control node.

Answer

Set 'backup: no' because backup creates additional files.

Answer

Set 'gather_facts: yes' to allow Ansible to locate the template.

Question 6

An administrator wants to define role dependencies. In which file should they place the dependencies declaration?

Accepted Answer

meta/main.yml. Role dependencies in Ansible are declared in the `meta/main.yml` file using the `dependencies` key. This allows you to specify other roles that must be executed before the current role, ensuring prerequisite tasks are run automatically.

Answer

vars/main.yml

Answer

defaults/main.yml

Answer

tasks/main.yml

Question 7

Refer to the exhibit. A playbook runs against the `web` group. What username will be used for host web2?

Accepted Answer

deploy. The playbook runs against the `web` group, and host `web2` inherits the `ansible_user` variable from the group-level inventory definition. In Ansible, the `ansible_user` variable determines the SSH username for the connection. Since the exhibit (not shown here but implied) sets `ansible_user: deploy` for the `web` group, all hosts in that group, including `web2`, will use `deploy` as the SSH username unless overridden at the host level.

Answer

undetermined

Answer

admin

Answer

root

Question 8

An organization uses Ansible Tower (AWX) for rolling updates. They have a job template that runs a playbook with serial: 5. The inventory contains 50 hosts. The update fails after the first batch due to a syntax error in a playbook. After fixing the error, the administrator wants to resume updating from where it left off without updating already successful hosts. Which approach achieves this?

Accepted Answer

Use the job template survey to input a list of hosts to skip, and pass it as --limit.. Ansible Tower's job template survey can collect a list of hosts to skip, which is then passed as the `--limit` option to the playbook. This allows the administrator to resume the rolling update from the next batch by excluding the first five already-successful hosts, avoiding re-running the playbook on them.

Answer

Create a new job template with a dynamic inventory subset excluding the first batch hosts.

Answer

Modify the playbook to check if a host has already been updated using a fact and skip it.

Answer

Rerun the entire playbook; Ansible will skip hosts that are already in the desired state.

Question 9

Which TWO statements about Ansible roles are true?

Accepted Answer

A role can include tasks, handlers, variables, templates, and files.. Ansible roles are designed to organize automation content into a standardized directory structure that can include tasks, handlers, variables, templates, and files. This modular structure allows for better code reuse and maintainability, as each component is stored in its own subdirectory within the role.

Answer

Roles are defined directly inside a playbook using the 'roles' keyword.

Answer

Roles can only be invoked using the 'include_role' module.

Answer

Variables defined in a role's vars/main.yml cannot be overridden by playbook variables.

Question 10

An organization uses separate network hops that require different SSH usernames for different inventory groups. Which Ansible configuration approach ensures each group uses the correct SSH user without duplicating playbooks?

Accepted Answer

Create a group_vars directory with a file named after the group containing ansible_user.. Creating a group_vars directory with a file named after a group and setting ansible_user inside it is the best practice for assigning different SSH users per group without duplicating playbooks. Option B is incorrect because specifying the SSH user in the inventory file for each host is possible but less scalable and harder to maintain. Option C is incorrect because setting ansible_user in ansible.cfg applies globally to all hosts, not per group. Option D is incorrect because defining ansible_user in the playbook using vars would require editing the playbook for each group, which leads to duplication and is not scalable.

Answer

Specify the SSH user in the inventory file for each host.

Answer

Set the ansible_user variable in ansible.cfg.

Answer

Define ansible_user in the playbook using vars.

Question 11

Refer to the exhibit. An administrator has configured ansible.cfg as shown. Which command will successfully install the 'community.general' collection from this server?

Accepted Answer

ansible-galaxy collection install community.general. The ansible.cfg file shown in the exhibit sets the `server` key under the `[galaxy]` section to a custom server URL (e.g., `https://private-galaxy.example.com`). When no `--server` flag is provided, `ansible-galaxy collection install` automatically uses the server defined in `ansible.cfg`. Therefore, the simple command `ansible-galaxy collection install community.general` will install the collection from the configured private server.

Answer

ansible-galaxy collection install community.general --server=https://galaxy.ansible.com

Answer

ansible-galaxy collection install community.general --ignore-certs

Answer

ansible-galaxy collection install community.general --force-with-deps

Question 12

An admin needs to restrict which users can launch specific job templates. Which AAP feature should be used?

Accepted Answer

Role-based access control (RBAC) on job templates.. Role-based access control (RBAC) on job templates is the correct feature because it allows an administrator to assign specific permissions (e.g., execute, read, or admin) to users or teams for individual job templates in Ansible Automation Platform (AAP). This directly restricts which users can launch specific job templates without affecting other resources.

Answer

Execution environments with custom modules.

Answer

Machine credentials with different users.

Answer

Inventory groups with host restrictions.

Question 13

An Ansible playbook uses the `fetch` module to retrieve files from managed hosts. Which TWO inventory variables are commonly used to construct unique destination paths for each host?

Accepted Answer

inventory_hostname. The `fetch` module retrieves files from managed hosts and stores them locally. To avoid overwriting files from different hosts, you must use unique destination paths. `inventory_hostname` provides the hostname as defined in the inventory, and `ansible_host` provides the actual IP or FQDN used to connect, both of which are commonly used to create distinct per-host directories or filenames.

Answer

dest

Answer

hostvars

Answer

group_names

Question 14

What does the `| quote` filter do in an Ansible task?

Accepted Answer

It escapes shell metacharacters to prevent shell injection.. The `| quote` filter in Ansible is designed to escape shell metacharacters (e.g., spaces, semicolons, backticks, dollar signs) in a string, ensuring that the value is safely passed to a shell command without risk of shell injection. This is critical when using variables in `command` or `shell` modules where user-supplied data could otherwise break the command or introduce security vulnerabilities.

Answer

It converts the string to uppercase.

Answer

It returns the string wrapped in double quotes.

Answer

It encodes the string for use in URLs.

Question 15

Drag and drop the steps to configure a basic NFS server to export a directory in the correct order.

Accepted Answer

Install NFS packages, create directory, configure /etc/exports, start NFS service, verify export. To configure a basic NFS server to export a directory, the correct sequence is: install the NFS packages (e.g., nfs-utils), create the directory to be shared, edit /etc/exports to define the export, start and enable the NFS server service, and finally verify the export using 'showmount -e localhost'. This workflow ensures that all prerequisites are met before each step, avoiding errors such as missing directories or unapplied configuration.

Answer

Install NFS packages, create directory, start NFS service, configure /etc/exports, verify export

Answer

Create directory, install NFS packages, configure /etc/exports, start NFS service, verify export

Answer

Install NFS packages, configure /etc/exports, create directory, start NFS service, verify export