EX294 Practice Test 14 — 15 Questions

Question 1

An administrator wants to use automation mesh to distribute workloads across multiple execution nodes. After configuring mesh topology, some jobs fail with: `Error: No healthy mesh node found for execution`. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The execution node is not registered with a unique `node_id`.. Each execution node in an automation mesh must have a unique `node_id` to be properly identified and reachable by the mesh controller. When nodes share a `node_id` or are not registered with a unique identifier, the controller cannot distinguish between them, leading to the 'No healthy mesh node found for execution' error. This uniqueness is critical for the mesh's peer-to-peer routing and health-checking mechanism.

Answer

The mesh nodes are not all connected to each other.

Answer

The `hop` count is set too high in the mesh configuration.

Answer

The `node_type` is set to `control` for all nodes.

Question 2

You are managing a Kubernetes cluster running a critical stateful application deployed as a StatefulSet with 3 replicas. The application uses persistent volumes with ReadWriteOnce access mode. You need to update the container image from version 1.0 to 1.1. The application's performance degrades if more than one replica is unavailable at any time. The StatefulSet is configured with the default RollingUpdate strategy (partition=0). You have a maintenance window of 30 minutes. The update must be completed within the window with minimal risk. Which of the following approaches should you take?

Accepted Answer

Use the default rolling update with partition=0; the StatefulSet will update one pod at a time automatically.. The default RollingUpdate strategy with partition=0 updates one pod at a time, ensuring that no more than one replica is unavailable at any moment. This matches the application's constraint that performance degrades if more than one replica is unavailable, and the 30-minute window is sufficient for a rolling update of 3 pods.

Answer

Manually delete each pod and let the StatefulSet recreate them with the new image.

Answer

Set maxUnavailable to 2 to speed up the rollout, then update the image.

Answer

Perform a canary update by setting partition to 2, updating one pod, validating, then setting partition to 0.

Question 3

A playbook uses a loop over a list of packages to ensure they are installed. However, the playbook runs slowly because each package is processed individually. Which optimization technique should be used to improve performance?

Accepted Answer

Pass the entire list to the package module's 'name' parameter instead of looping.. Ansible's package modules (such as yum, apt, or dnf) accept a list of packages in the 'name' parameter. Passing the entire list in a single task eliminates the overhead of multiple task executions, SSH connection reuse, and module setup/teardown that occur with each iteration in a loop. This reduces the number of Ansible task runs from N to 1, significantly improving performance.

Answer

Use with_items instead of loop; with_items is faster.

Answer

Set the async parameter on the looped task to run packages in parallel.

Answer

Use the serial keyword at the play level to increase parallelism.

Question 4

Match each firewall zone to its default behavior.

Accepted Answer

public: Rejects incoming traffic except for explicitly allowed services.. Common firewalld zones include public (default deny), trusted (allow all), external (NAT with limited inbound), dmz (limited inbound for public servers), internal (trusted but filtered), and drop (silent discard). Common confusions involve swapping the behaviors of public and trusted, or misunderstanding dmz as fully blocking instead of selectively allowing.

Answer

internal: Allows all incoming traffic from any source.

Answer

dmz: Drops all incoming traffic.

Question 5

Your organization manages a fleet of 500 web servers running RHEL 8. Each server has a custom fact file /etc/ansible/facts.d/web.fact containing:
[web]
docroot=/var/www/html
port=80
admin=admin@example.com

You have a playbook that needs to configure the firewall to allow traffic on the port defined in the custom fact for each server. The playbook uses the 'ansible_local' variable to access these facts. However, some servers have the custom fact file missing or malformed. The task to open the firewall port fails on those servers with 'VARIABLE IS UNDEFINED'. You need to implement a solution that handles missing custom facts gracefully, setting a default port of 8080 if the fact is not defined, and still log a warning. Which approach should you take?

Accepted Answer

Use a 'set_fact' task with 'port: "{{ ansible_local.web.port | default(8080) }}"' and add a 'debug' task with 'when: ansible_local.web.port is undefined' to warn.. It uses the `default` filter to gracefully handle undefined variables, setting a fallback port of 8080 when the custom fact is missing or malformed. The additional `debug` task with `when: ansible_local.web.port is undefined` provides a warning without causing the playbook to fail. This approach aligns with the EX294 objective of transforming data with filters and plugins, specifically using Jinja2 filters to manage missing data.

Answer

Use 'ignore_errors: yes' on the firewall task and then check the result with 'failed_when' to set a default.

Answer

Use 'block' and 'rescue' to catch the error and then set the fact.

Answer

Create a separate playbook for servers without the fact file, running a different role.

Question 6

An Ansible administrator wants to use an encrypted vault file to store sensitive variables. Which command creates a new vault file and prompts for a password?

Accepted Answer

ansible-vault create secrets.yml. `ansible-vault create secrets.yml` creates a new encrypted vault file and immediately prompts the user to set a password, which is then used to encrypt the file. This command is specifically designed for initial creation of vault files, unlike `edit` which requires an existing file, `view` which only displays content, or `encrypt` which encrypts an existing plaintext file.

Answer

ansible-vault edit secrets.yml

Answer

ansible-vault view secrets.yml

Answer

ansible-vault encrypt secrets.yml

Question 7

An Ansible playbook that deploys a web application includes a task that uses the `uri` module to call an external API. The task occasionally fails due to API rate limiting. Which combination of keywords should be added to the task to automatically retry up to 5 times with a 30-second delay between attempts, and only fail if all retries are exhausted?

Accepted Answer

`register: result`, `until: result.status == 200`, `retries: 5`, `delay: 30`. It combines `register` to capture the API response, `until` to check that `result.status` equals 200 (the HTTP success code), `retries: 5` to attempt the task up to five times, and `delay: 30` to wait 30 seconds between retries. This ensures the task only fails after all five retries are exhausted, which is the exact behavior needed to handle transient API rate limiting.

Answer

`register: result`, `until: status == 200`, `retries: 5`, `delay: 30`

Answer

`until: result.status == 200`, `retries: 5`, `delay: 30`

Answer

`register: result`, `retries: 5`, `delay: 30`

Question 8

A playbook uses the 'block' and 'rescue' keywords to handle errors. The block contains three tasks. The first task fails. What happens next?

Accepted Answer

The rescue section runs immediately after the failure.. In Ansible, when a task inside a `block` fails, the `rescue` section is executed immediately after the failure, without running any remaining tasks in the block. This is analogous to a try-catch mechanism in programming: the block is the 'try', and the rescue is the 'catch'. Option B correctly describes this behavior.

Answer

The rescue section runs and retries the failed task.

Answer

The playbook fails with an error message.

Answer

The remaining tasks in the block run, then the rescue section runs.

Question 9

An Ansible Tower administrator wants to allow a team to run playbooks against a set of production web servers without giving them direct SSH access to the hosts. Which inventory configuration approach should be used?

Accepted Answer

Create a smart inventory and use the 'prod_web' tag to filter hosts. Smart inventories in Ansible Tower allow you to define a dynamic set of hosts based on a filter, such as a tag (e.g., 'prod_web'). This enables the team to run playbooks against production web servers without granting them direct SSH access to the hosts, as Tower manages the SSH connections centrally using its own credentials.

Answer

Use the ad hoc inventory feature to specify hosts at launch time

Answer

Define a group variable for production web servers in the inventory

Answer

Create a static inventory and add each web server manually

Question 10

A large-scale Ansible deployment processes a list of thousands of network devices. Using the `subelements` filter to iterate over interfaces is causing very slow playbook execution. Which approach can significantly improve performance?

Accepted Answer

Use a custom filter plugin in Python that uses list comprehensions. The `subelements` filter in Ansible processes nested data structures by iterating over each parent element and its child elements, which can be extremely slow for large datasets due to the overhead of Jinja2 template evaluation and repeated lookups. A custom filter plugin written in Python using list comprehensions avoids this overhead by executing native Python code directly, which is significantly faster because it operates at the interpreter level without the iterative Jinja2 expansion. This approach reduces the number of tasks and template evaluations, improving performance for thousands of network devices.

Answer

Use `with_nested` instead

Answer

Use `set_fact` with loops inside the task

Answer

Use `with_items` with `json_query` instead

Question 11

Refer to the exhibit. An administrator runs the playbook but the wait_for task fails. What is the most likely cause?

Accepted Answer

The ansible_facts variable may not be available because fact gathering is disabled.. The playbook uses `ansible_facts['ansible_tcpip_socket']['port']` to supply the port number to the `wait_for` module. If fact gathering is disabled (e.g., via `gather_facts: no` at the play level or `ANSIBLE_GATHERING=explicit`), the `ansible_facts` dictionary is empty, so the variable resolves to `None` or an undefined value, causing the task to fail. The error is not a syntax or type issue but a missing fact dependency.

Answer

The http_port variable is misspelled.

Answer

The wait_for module requires the 'port' parameter to be an integer.

Answer

The delegate_to should be set to the remote host.

Question 12

A DevOps engineer is responsible for coordinating a rolling update of a Red Hat OpenShift Container Platform 4.12 cluster with 10 worker nodes. The cluster hosts a stateful application that uses persistent volumes with ReadWriteOnce access mode. The update involves a minor version upgrade of the cluster from 4.12.0 to 4.12.5. The engineer uses the recommended `oc adm upgrade` command. During the update, after the first worker node is updated, the engineer notices that the node's status shows 'NotReady' and the cluster version operator reports a degraded status. A check of the node logs reveals 'kubelet: Failed to run kubelet: Could not get kubelet config from cluster: could not get config from cluster: context deadline exceeded'. Which action should the engineer take first?

Accepted Answer

Check the network connectivity between the updated node and the control plane nodes on port 6443.. The error indicates the kubelet cannot communicate with the control plane on port 6443, likely due to a network issue (e.g., firewall, DNS, or routing). Option A is wrong because rolling back the entire cluster is a drastic first step; the issue is likely isolated. Option C is wrong because changing kubelet parameters is not a standard resolution for connectivity problems. Option D is wrong because rebuilding the node from scratch is unnecessary and time-consuming; the issue is likely resolvable by restoring network connectivity.

Answer

Rebuild the node from scratch using the machine config operator.

Answer

Roll back the entire cluster to version 4.12.0 using the `oc adm upgrade --to=4.12.0` command.

Answer

Increase the kubelet's `--node-status-update-frequency` parameter on the updated node.

Question 13

An Ansible Tower administrator notices that a job template using a dynamic inventory source from AWS EC2 is not updating when new instances are launched. The inventory source is set to update on launch. What is the most likely cause?

Accepted Answer

The AWS credential associated with the inventory source is invalid or expired.. The most likely cause of a dynamic inventory source not updating is that the associated AWS credential is invalid or expired. When the 'update on launch' option is enabled, Ansible Tower attempts to refresh the inventory from the source before each job run. If the credential (e.g., AWS access key ID and secret access key) is no longer valid, the inventory update will fail silently or with an error, and the job will use stale cached data.

Answer

The inventory source cache timeout is set too high.

Answer

The 'update on launch' option is disabled.

Answer

The inventory source is configured as a custom script.

Question 14

A DevOps engineer wants to run an Ansible playbook inside a specific execution environment (EE) that includes custom collections. The EE image is stored in a private registry requiring authentication. The engineer has configured a container credential file. Which command will execute the playbook using the EE and the credential file?

Accepted Answer

ansible-navigator run -m stdout --ce docker --container-image registry.example.com/custom-ee --container-auth-file auth.json. `ansible-navigator` uses the `--container-auth-file` flag to specify a container credential file (typically in JSON format) for authenticating to a private registry. The `-m stdout` flag sets the execution mode to stdout, and `--ce docker` selects Docker as the container engine. This command correctly references the EE image and the auth file, enabling the playbook to run inside the authenticated custom execution environment.

Answer

ansible-navigator run -m stdout --ce docker --container-image registry.example.com/custom-ee --container-auth-file credentials.yml

Answer

ansible-navigator run --pp never --ce docker --container-image registry.example.com/custom-ee

Answer

ansible-navigator run -m stdout --pp never --ce docker --container-image registry.example.com/custom-ee --container-credential-file credentials.yml

Question 15

A DevOps team is developing a collection of Ansible roles to standardize web server deployments. One role, 'webserver-base', configures the firewall and installs common packages. Another role, 'webserver-app', depends on 'webserver-base' and adds application-specific configurations. The team wants to ensure that when 'webserver-app' is applied to a host, 'webserver-base' is automatically applied first. They currently have a 'meta/main.yml' file in 'webserver-app' that lists 'webserver-base' as a dependency. However, when they run a playbook that includes 'webserver-app' in a role list, they notice that 'webserver-base' runs after 'webserver-app' sometimes, causing configuration conflicts. They verify that the dependency is correctly defined and that no other roles are involved. What change should they make to ensure 'webserver-base' always runs before 'webserver-app'?

Accepted Answer

Set 'static: yes' in the dependency entry in the dependent role's meta/main.yml.. By default, role dependencies are executed before the dependent role. However, when roles are included dynamically (e.g., via `include_role`), the order may not be guaranteed. Setting `static: yes` in the dependency entry in `meta/main.yml` forces Ansible to statically inline the dependency at playbook parse time, ensuring that `webserver-base` always runs before `webserver-app`. Option B is correct because it directly addresses the ordering issue by making the dependency static. Option A is incorrect because `include_role` is a dynamic inclusion module, not a dependency type. Option C is incorrect because `order` is not a valid attribute for dependencies. Option D is a playbook-level workaround but does not enforce the dependency when the role is used elsewhere.

Answer

Change the dependency type to 'include_role' in the playbook to control ordering.

Answer

Add 'order: before' to the dependency entry in meta/main.yml.

Answer

Add a 'pre_tasks' section in the playbook to include 'webserver-base' before 'webserver-app'.