EX294 Practice Test 13 — 15 Questions

Question 1

A systems administrator needs to run a playbook that installs packages on a group of managed nodes. The playbook should run only on nodes that are part of the 'web_servers' group in the inventory. Which approach is best practice?

Accepted Answer

Set 'hosts: web_servers' in the play.. Option A is correct because setting 'hosts: web_servers' in the play directly targets only the nodes in that inventory group, which is the simplest and most maintainable approach. This follows Ansible's best practice of declaring the target group explicitly in the playbook rather than relying on runtime flags or conditional logic, ensuring the playbook's intent is clear and portable.

Answer

Set 'hosts: all' and use '--limit web_servers' when running ansible-playbook.

Answer

Set 'hosts: localhost' and delegate tasks to web_servers.

Answer

Set 'hosts: all' and use a 'when' condition to check if the node is in the web_servers group.

Question 2

Refer to the exhibit. The playbook uses the 'yum' module to install 'httpd' on a RHEL 8 system. Which of the following is the most likely cause of the failure?

Accepted Answer

The AppStream repository is not enabled on the target host.. On RHEL 8, the `yum` command is a symbolic link to `dnf`, and the `yum` Ansible module internally uses `dnf` as the backend. The most common cause of failure when installing a package like `httpd` on RHEL 8 is that the AppStream repository (which contains `httpd`) is not enabled or available on the target host. Without an enabled repository containing the package, the module cannot resolve and install it, leading to a failure.

Answer

The 'yum' module is deprecated for RHEL 8; must use 'dnf'.

Answer

The remote host does not have subscription-manager access.

Answer

The package name is misspelled; it should be 'apache2'.

Question 3

An Ansible playbook needs to generate a list of IP addresses from a range 192.168.1.10 to 192.168.1.20. Which filter should be used in a Jinja2 template?

Accepted Answer

{{ '192.168.1.10-20' | ipaddr('range_include') }}. Option B is correct because the `ipaddr` filter with the `'range_include'` parameter generates a list of all IP addresses within a specified range, including both endpoints. In this case, `'192.168.1.10-20' | ipaddr('range_include')` produces a list from 192.168.1.10 through 192.168.1.20, which is exactly what the playbook needs to generate.

Answer

Answer

Answer

Question 4

A team develops an Ansible collection and wants to distribute it internally. They have a private Automation Hub. Which approach best ensures that collection dependencies from external sources are also available?

Accepted Answer

Define a requirements.yml in the execution environment that references both the private hub and external sources. Option B is correct because defining a `requirements.yml` in the execution environment allows you to specify collections from both the private Automation Hub and external sources (e.g., Ansible Galaxy). When building the execution environment, `ansible-builder` processes this file and resolves dependencies from the listed sources, ensuring all required collections are bundled into the container image. This approach automates dependency management and avoids manual installation or repository bloat.

Answer

Manually install each dependency on the control node

Answer

Include all dependencies directly in the collection's repository

Answer

Use ansible-galaxy collection download and then upload to private hub

Question 5

An admin attempts to build an execution environment using the exhibited files. The build fails with an error about incompatible Python dependency. What is the most likely cause?

Accepted Answer

The Python requirements.txt tries to install a version of Ansible that conflicts with the version in the base image.. The build fails because the Python `requirements.txt` file attempts to install a version of Ansible that conflicts with the version already present in the base image `ee-minimal-rhel8`. Execution environments are designed to include a specific Ansible version in the base image; adding a different version via pip creates a dependency conflict that breaks the build.

Answer

The execution-environment.yml file uses incorrect syntax for the 'dependencies' section.

Answer

The collections in requirements.yml are not fully qualified.

Answer

The base image 'ee-minimal-rhel8' is not a valid execution environment base image.

Question 6

An Ansible automation engineer is developing a role that manages a microservice. The role needs to include conditional tasks based on whether a variable `microservice_version` is defined. If defined, it should use that version; otherwise, it should default to `latest`. Which of the following is the most efficient and idiomatic way to implement this default value within the role?

Accepted Answer

In the task: `image: "myimage:{{ microservice_version | default('latest') }}"`. Option D is correct because it uses the `default` filter directly in the task to set a fallback value for `microservice_version` when it is undefined. This is the most efficient and idiomatic approach in Ansible, as it avoids modifying role defaults or introducing extra variables, and it handles the conditional logic inline without unnecessary complexity.

Answer

In `defaults/main.yml`: `microservice_version: latest` and reference `{{ microservice_version }}` in the task.

Answer

In the task: `image: "myimage:{{ microservice_version }}"` and use `| mandatory` to fail if undefined.

Answer

In the task: `vars: microservice_version: "{{ microservice_version | default('latest') }}"`

Question 7

Which TWO statements are true about Ansible content collections?

Accepted Answer

Collections can be installed from Automation Hub, Galaxy, or a Git repository.. Option A is correct because Ansible collections can be installed from multiple sources: Automation Hub (a Red Hat curated repository), Galaxy (the community repository), or directly from a Git repository using the `ansible-galaxy collection install` command with a Git URL. This flexibility allows users to leverage curated, community, or custom collections as needed.

Answer

Collections cannot contain playbooks.

Answer

A role stored in a collection can be referenced by its short name without the collection prefix.

Answer

Execution environments are required to use collections.

Question 8

An organization has multiple automation controller clusters spread across different geographic regions. The security policy requires that job artifacts (such as logs and assets) must remain in the region where the job ran. Which THREE configurations support this requirement? (Choose exactly three.)

Accepted Answer

Disable the 'Enable remote logging' option in the controller configuration for each cluster.. Option A is correct because disabling 'Enable remote logging' in the controller configuration ensures that job artifacts (logs, assets) are stored locally on the controller's filesystem rather than being forwarded to an external logging server. This directly enforces the regional data residency requirement by preventing artifacts from leaving the geographic region where the controller cluster resides.

Answer

Use a custom execution environment that writes artifacts to a network share.

Answer

Configure automation mesh to route jobs to the nearest execution node.

Question 9

An Ansible Engineer is planning a rolling update for a web application deployed across 10 nodes. The playbook uses the 'delegate_to' directive to manage load balancer health checks. Which of the following best describes the recommended approach to minimize downtime?

Accepted Answer

Use 'serial: 1' and delegate load balancer disable/enable tasks to localhost, ensuring each node is taken out of rotation before updating.. Option A is correct because using 'serial: 1' ensures that only one node is updated at a time, and delegating load balancer disable/enable tasks to localhost (or the Ansible control node) allows the playbook to interact with the load balancer API to remove the node from the pool before the update and re-add it after. This minimizes downtime by ensuring traffic is not sent to a node being updated, while other nodes continue serving requests.

Answer

Run the update playbook with 'serial: 10' to update all nodes at once, then run a separate playbook to update the load balancer.

Answer

Run the update on each node manually using 'ansible-playbook --limit' and skip load balancer management to save time.

Answer

Use 'strategy: free' to allow nodes to update independently without controlling the load balancer.

Question 10

Match each systemd unit type to its description.

Question 11

Match each firewall zone to its default behavior.

Question 12

Match each Ansible playbook directive to its purpose.

Question 13

Match each storage concept to its description.

Question 14

Which TWO statements about Ansible roles are true?

Accepted Answer

A role can include tasks, handlers, variables, templates, and files.. Option A is correct because Ansible roles are designed to organize automation content into a standardized directory structure that can include tasks, handlers, variables, templates, and files. This modular structure allows for better code reuse and maintainability, as each component is stored in its own subdirectory within the role.

Answer

Roles are defined directly inside a playbook using the 'roles' keyword.

Answer

Roles can only be invoked using the 'include_role' module.

Answer

Variables defined in a role's vars/main.yml cannot be overridden by playbook variables.

Question 15

A team runs the playbook shown in the exhibit. They notice that during the update, some requests are still being sent to servers that have been disabled. What is the most likely cause?

Accepted Answer

The 'serial: 2' setting allows two hosts to be disabled simultaneously, and the load balancer may not have drained connections.. Option B is correct because the `serial: 2` setting causes Ansible to update two hosts at a time. When a host is disabled in the load balancer, existing connections may not be fully drained before the next batch of hosts is updated, allowing traffic to still reach disabled servers. The load balancer needs time to drain active sessions, and a serial batch of 2 can overlap with that drain window.

Answer

The disable task should use 'state: maintenance' instead of 'state: disabled'.

Answer

The 'delegate_to' should be set to localhost, not lb01.

Answer

The 'serial' keyword is incorrectly used as a global variable.