EX294 Practice Test 12 — 15 Questions

Question 1

A junior admin wants to remove a credential from Ansible Tower. Which role-based access control permission is required to delete a credential?

Accepted Answer

Admin. In Ansible Tower, the Admin role is the only role that grants full management permissions, including the ability to delete credentials. Lower-level roles like Read, Use, and Execute only allow viewing or using credentials, not modifying or deleting them. This aligns with Tower's RBAC hierarchy where Admin is required for destructive actions on any resource.

Answer

Read

Answer

Use

Answer

Execute

Question 2

An organization's execution environment must include a custom RPM that is not in the default base image. How should this be added in the execution-environment.yml?

Accepted Answer

Add the RPM to the 'dependencies' section under 'system'.. In an execution-environment.yml file, custom RPM packages that are not part of the default base image must be listed under the 'dependencies' section with the 'system' key. This instructs ansible-builder to install those RPMs using the system package manager (e.g., dnf or yum) during the build process, ensuring the execution environment includes the required system-level libraries or tools.

Answer

Add the RPM to the 'dependencies' section under 'python'.

Answer

Use a 'prepended_base' directive.

Answer

Use a custom base image that includes the RPM.

Question 3

An Ansible playbook includes a role that defines default variables in 'defaults/main.yml' and role variables in 'vars/main.yml'. A playbook sets the same variable in the play's 'vars' section. Which variable value takes precedence?

Accepted Answer

Play vars. In Ansible, variable precedence is hierarchical, and play vars (set directly in the play's `vars` section) have a higher priority than role defaults and role vars. Specifically, play vars override role vars, which in turn override role defaults. Therefore, when the same variable is defined in all three locations, the play vars value takes precedence.

Answer

Role defaults

Answer

Inventory group vars

Answer

Role vars

Question 4

A company wants to implement a rolling update for a stateful application where hosts cannot be updated in parallel due to data consistency. They also need to ensure that if any host fails, the entire update is rolled back. Which strategy meets these requirements?

Accepted Answer

Use serial: 1 and any_errors_fatal: yes. Setting `serial: 1` ensures hosts are updated one at a time, preventing parallel updates that could break data consistency for a stateful application. Adding `any_errors_fatal: yes` causes the entire playbook run to abort immediately if any host fails, which satisfies the requirement for a full rollback on failure.

Answer

Use serial: 2 and any_errors_fatal: yes

Answer

Use serial: 1 and ignore_errors: yes

Answer

Use serial: 0 and max_fail_percentage: 0

Question 5

An organization needs to implement security best practices for Ansible automation. Which three measures should be taken? (Choose three.)

Accepted Answer

Use ansible-vault to encrypt sensitive variables. Option A is correct because ansible-vault encrypts sensitive variables and files (e.g., via `ansible-vault encrypt` or `encrypt_string`) so secrets such as passwords and API keys are not exposed in plain text within playbooks or repositories. Option C is correct because regularly rotating Ansible Vault passwords limits the impact of a compromised vault password and should be paired with `ansible-vault rekey` to re-encrypt vaulted content under the new password. Option E is correct because limiting access to the automation controller with role-based access control (RBAC) enforces least privilege, ensuring only authorized users or teams can launch jobs, edit credentials, or manage inventories. Option B is not acceptable since storing secrets in plain text in a repository exposes them to anyone with repo access and violates security best practices. Option D is wrong because disabling SSH host key checking globally removes protection against man-in-the-middle attacks and should not be done as a security measure.

Answer

Store all secrets in plain text in repository

Answer

Disable SSH host key checking globally

Question 6

In OpenShift, a deployment must gradually shift traffic to new pods during a rolling update. Which default strategy achieves this?

Accepted Answer

RollingUpdate. The RollingUpdate strategy is the default deployment strategy in OpenShift (and Kubernetes) that gradually replaces old pods with new ones while maintaining application availability. It achieves this by incrementally scaling down the old ReplicaSet and scaling up the new one, controlled by parameters like maxSurge and maxUnavailable, ensuring a smooth transition of traffic to new pods.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Custom strategy

Answer

Recreate

Question 7

A playbook uses the 'block' and 'rescue' keywords. If a task in the block fails, but the rescue tasks also fail, what happens?

Accepted Answer

The play fails.. When a task in a block fails, the rescue tasks execute. If the rescue tasks also fail, the entire play fails (the failure propagates). Option B is incorrect because the play does not continue; it fails. Option C is incorrect because the block is not re-executed; rescue only runs once. Option D is incorrect because rescue tasks are not retried after failure.

Answer

The play continues to the next task.

Answer

The block is re-executed.

Answer

The rescue tasks are retried.

Question 8

A systems administrator needs to use a different SSH private key for a group of hosts in an Ansible inventory. Which inventory variable should be set at the group level?

Accepted Answer

ansible_ssh_private_key_file. `ansible_ssh_private_key_file` is the Ansible inventory variable that specifies the path to the SSH private key file for a host or group. When set at the group level, it applies to all hosts in that group, allowing the administrator to use a different key for authentication without modifying individual host definitions.

Answer

ansible_ssh_key

Answer

ansible_ssh_key_file

Answer

ansible_private_key

Question 9

Which THREE files are commonly used when building an execution environment with ansible-builder?

Accepted Answer

bindep.txt. ansible-builder builds an execution environment from a definition directory, and the three commonly used input files are execution-environment.yml, requirements.txt, and bindep.txt. Option D (execution-environment.yml) is the main definition file that declares the base image, dependencies, and additional build steps for the execution environment. Option E (requirements.txt) lists the Python packages (such as ansible-core, ansible-runner, and collections' Python dependencies) to install into the image. Option A (bindep.txt) specifies system-level (RPM/OS) package requirements that must be installed in the container image. Option B (ansible.cfg) is an Ansible runtime configuration file and is not a standard ansible-builder input, and Option C (galaxy.yml) is a collection metadata file used when building or publishing Ansible collections, not for building execution environments.

Answer

ansible.cfg

Answer

galaxy.yml

Question 10

Which TWO filters are commonly used to manipulate JSON data in Ansible? (Select exactly two.)

Accepted Answer

from_json. (from_json) is correct because it converts a JSON string into an Ansible data structure (dict or list), enabling further manipulation with filters like json_query. This is essential when parsing API responses or configuration files that return JSON-formatted strings.

Answer

flatten

Answer

regex_replace

Answer

to_json

Question 11

An Ansible playbook runs tasks on a group of web servers. During a rolling update, the playbook should ensure that no more than 2 servers are taken out of service at the same time. Which play keyword should be used?

Accepted Answer

serial: 2. The `serial` keyword controls the batch size of hosts that Ansible executes a play against. Setting `serial: 2` ensures that only 2 web servers are processed at a time, which is exactly what is needed for a rolling update where no more than 2 servers should be taken out of service simultaneously.

Answer

forks: 2

Answer

max_fail_percentage: 2

Answer

throttle: 2

Question 12

What is the effect of the `filter_plugins` setting in `ansible.cfg`?

Accepted Answer

It adds the directory to the default search path for filter plugins.. The `filter_plugins` setting in `ansible.cfg` adds the specified directory to the default search path for filter plugins, not replacing it. Ansible searches default locations like `~/.ansible/plugins/filter` and the `filter_plugins` directory relative to the playbook, in addition to any directories specified by this setting. Therefore, option D is correct.

Answer

It sets the directory for filter plugins but only for the current playbook.

Answer

It configures the path for lookup plugins, not filter plugins.

Answer

It replaces the default search path for filter plugins with the specified directory.

Question 13

A job template runs successfully on some hosts but fails on others with 'Permission denied' for the same task. The admin has verified that the credential is correct. What is the most likely cause?

Accepted Answer

The privilege escalation method (become method) differs among hosts.. B is correct because the 'Permission denied' error on a task that runs successfully on some hosts but not others, despite a verified credential, typically indicates a privilege escalation issue. The become method (e.g., sudo, su, pbrun) may be configured differently or unsupported on the failing hosts, causing Ansible to fail when attempting to escalate privileges for the task. Since the credential is correct, the failure occurs during the become process, not authentication.

Answer

The package repository is not accessible from those hosts.

Answer

The credential's username is incorrect for some hosts.

Answer

The SSH key is not accepted on some hosts.

Question 14

A company is deploying Ansible Automation Platform (AAP) in a three-node cluster: one automation controller node, one private automation hub node, and one database node (PostgreSQL). The deployment uses an execution environment that pulls from the private automation hub. After a successful installation, all nodes are reachable and services are running. However, when launching a job template that uses the execution environment, the job fails with the error: 'Unable to pull execution environment image from automation-hub.example.com:5000/ee/my-ee:latest - request to registry failed with status 403 Forbidden'. The administrator confirms that the execution environment image exists in the private automation hub and that the automation controller node can reach the registry via curl. What is the most likely cause and solution?

Accepted Answer

Create a container registry credential in automation controller that uses the pull token from private automation hub, and associate it with the execution environment.. The 403 Forbidden error indicates that the automation controller cannot authenticate to the private automation hub container registry. Even though the image exists and network connectivity works, the controller needs a container registry credential configured with the pull token from the private automation hub. This credential must be associated with the execution environment. Option A is wrong because disabling authentication compromises security and is not the intended solution. Option B is wrong because SELinux would produce a different error (e.g., permission denied), not a 403. Option D is wrong because the 'pull' field does not affect authentication; the error is about authentication, not pull policy.

Answer

The private automation hub is configured to allow unauthenticated access; change the hub configuration to disable authentication.

Answer

SELinux on the controller node is blocking container pulls; temporarily set SELinux to permissive.

Answer

The execution environment definition in the controller is missing the 'pull' field; add 'pull: always' to the job template.

Question 15

The inventory above is used in a job template in Automation Controller. The job template also has a machine credential assigned that specifies username 'root' and an SSH key. When the job runs against host web1, which username will Ansible use to connect?

Accepted Answer

admin (from inventory host variable). Ansible uses a specific precedence order for determining the connection user. When a host variable (like `ansible_user: admin`) is defined in the inventory for host web1, it overrides the username set in the job template's machine credential. The credential's username ('root') acts only as a fallback if no `ansible_user` is defined at the host or group level.

Answer

The username set in the job template's 'extra variables'

Answer

The first defined username in the credential chain

Answer

root (from credential)