EX294 Practice Test 14 — 15 Questions

Question 1

During a rolling update using an Ansible playbook with serial: 2, one host in the first batch becomes unreachable. The playbook fails with an unreachable host error. How should the administrator proceed to complete the update on the remaining hosts while excluding the problematic host?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use 'ansible-playbook playbook.yml --limit all:!hostname' to exclude the unreachable host.. The `--limit` flag with the pattern `all:!hostname` uses Ansible's inventory host pattern syntax to exclude a specific host from the playbook run. This allows the administrator to rerun the playbook against all hosts except the unreachable one, completing the rolling update without re-attempting the failed host. The `serial: 2` setting is irrelevant once the host is excluded, as the playbook will only target the remaining reachable hosts.

Answer

Use 'ansible-playbook playbook.yml --forks 1' to slow down the update.

Answer

Add 'any_errors_fatal: false' to the playbook and rerun.

Answer

Rerun the playbook with the same command; it will skip the unreachable host automatically.

Question 2

A sysadmin receives an error when running a job template: 'ERROR! the role 'common' was not found in the specified roles path'. The role exists in a source control repository referenced in the project. What is the most likely cause?

Accepted Answer

The project's source control sync failed, so the roles directory is empty. The error indicates that Ansible cannot find the 'common' role in the specified roles path. Since the role exists in the source control repository referenced by the project, the most likely cause is that the project's source control sync failed, leaving the roles directory empty or incomplete. Without a successful sync, the role files are not present on the Ansible control node, causing the job template execution to fail.

Answer

The inventory does not include the target hosts

Answer

The job template is configured with an incorrect schedule

Answer

The credential used does not have access to the source control repository

Question 3

A company uses Ansible Vault to encrypt sensitive data in playbooks. They have multiple environments (dev, test, prod) and use a separate vault password file for each environment. The passwords are stored in files named 'vault-pass-dev', 'vault-pass-test', and 'vault-pass-prod'. To run a playbook against the test environment, they use the command 'ansible-playbook site.yml -i test -e @test-vars.yml --vault-id test@vault-pass-test'. This runs successfully from the command line. However, when they define the same vault-id in an Ansible Tower credential and attempt to run the job, the job fails with 'ERROR! Decryption failed (no vault secrets would be found that could decrypt the vault encrypted file)' for a vault-encrypted variable file that was encrypted with a different vault ID (e.g., 'dev'). The team expects that Tower would use the provided vault credential to decrypt all vault-encrypted files. Which change should be made to ensure correct decryption in Tower?

Accepted Answer

Add multiple vault credentials to the job template, one for each vault ID used in the project.. In Ansible Tower, each vault credential is associated with a single vault ID and password. To decrypt files encrypted with different vault IDs, you must attach multiple vault credentials to the job template, each corresponding to a vault ID used in the project. This allows Tower to try each credential until decryption succeeds. The command-line success with a single vault-id works because only files encrypted with that ID are decrypted; files with other IDs would fail unless multiple --vault-id options are provided.

Answer

Enter all vault passwords separated by commas in the 'VAULT PASSWORD' field of a single credential.

Answer

Re-encrypt all files with the same vault ID (e.g., 'default') to simplify the setup.

Answer

Change the vault password file to contain the password for the vault ID that was used to encrypt the file.

Question 4

An administrator needs to securely pass a database password to a playbook without exposing it in logs or the command line. Which approach is the most secure?

Accepted Answer

Store the password in an Ansible Vault-encrypted variable file and include it.. Ansible Vault encrypts the variable file at rest, and including it via `vars_files` or `include_vars` decrypts it only in memory during playbook execution. This prevents the password from appearing in logs, the command line, or the process table, meeting the security requirement.

Answer

Set the password in a variable and use 'no_log: true' on tasks that use it.

Answer

Store the password in a host_vars file with restricted file permissions.

Answer

Prompt for the password and pass it as an extra variable using -e.

Question 5

Which TWO options are valid methods for including collections in an execution environment?

Accepted Answer

List collections under 'collections' in execution-environment.yml.. Option B is correct because the execution-environment.yml definition file supports a 'collections' key where you list collection names (and optionally versions/sources) that ansible-builder will install into the resulting execution environment image. Option D is correct because ansible-builder recognizes a requirements.yml file (referenced via the 'dependencies' section, e.g. galaxy: requirements.yml) that specifies collections to install, using the standard Galaxy requirements format. Option A is not the intended answer because running ansible-galaxy collection install in a pre-build script is a manual workaround rather than a declared, supported method for including collections in the execution environment definition. Option C is incorrect because galaxy.yml is a collection's own metadata/manifest file used when building or publishing a collection, not a mechanism for adding collections to an execution environment. Option E is incorrect because baking collections into the base image is not a valid ansible-builder method for including collections; collections should be declared in the execution environment definition so they are installed during the build.

Answer

Use ansible-galaxy collection install command in a pre-build script.

Answer

Use a 'galaxy.yml' file in the build context.

Answer

Include collections in the base image directly.

Question 6

Given a list of dictionaries `users` with keys `name` and `role`, a playbook needs to create a list of names where role is 'admin'. Which expression achieves this?

Accepted Answer

{{ users | selectattr('role', 'equalto', 'admin') | map(attribute='name') | list }}. It first uses `selectattr` to filter the list of dictionaries, keeping only those where `role` equals `'admin'`, then applies `map(attribute='name')` to extract the `name` values from the filtered dictionaries, and finally converts the result to a list with the `list` filter. This produces a list of names for admin users.

Answer

{{ users | map(attribute='name') | selectattr('role', 'equalto', 'admin') | list }}

Answer

{{ users | json_query("[?role=='admin'].{name: name}") }}

Answer

Question 7

An administrator wants to run a playbook that executes tasks in parallel across multiple hosts but wants to limit the number of simultaneous hosts to 5. Which directive should be set?

Accepted Answer

serial. The `serial` directive in Ansible controls the number of hosts that execute a play at a time, allowing you to limit concurrency. Setting `serial: 5` ensures that only 5 hosts run tasks simultaneously, with the playbook completing in batches of 5 until all hosts are processed.

Answer

poll

Answer

throttle

Answer

forks

Question 8

Refer to the exhibit. A user runs ansible-runner with --container-image localhost/ee-30:latest and receives the error shown. What is the most likely cause?

Accepted Answer

The container image has not been pulled or built locally.. The error indicates that the container image `localhost/ee-30:latest` is not available locally. The `--container-image` flag tells ansible-runner to use a specific execution environment image, but if that image has not been pulled from a registry or built locally, the container runtime (e.g., Podman or Docker) cannot find it. Option D is correct because the image must exist in the local container storage before ansible-runner can launch it.

Answer

The container image tag is incorrect.

Answer

The ansible-runner process does not have network access.

Answer

The execution environment is not listed in the project's execution-environment.yml.

Question 9

An admin configures an automation mesh environment. What is the primary purpose of mesh nodes in AAP?

Accepted Answer

To scale automation execution capacity.. Mesh nodes in Ansible Automation Platform (AAP) are designed to distribute automation execution workloads across multiple nodes, enabling horizontal scaling. They do not handle the web UI, controller logic, or database functions; instead, they execute playbooks and jobs, offloading work from the automation controller to increase overall capacity and performance.

Answer

To enable high availability for the web UI.

Answer

To act as a backup for the automation controller.

Answer

To provide a redundant database server.

Question 10

A playbook uses the 'block' feature to group tasks and includes a 'rescue' section. If a task inside the block fails, what happens?

Accepted Answer

The rescue tasks run, and the play continues with the next task after the block.. In Ansible, when a task inside a `block` fails, the `rescue` section is executed to handle the failure. After the rescue tasks complete successfully, the play continues with the next task after the block, not from the beginning of the block. This behavior allows for error recovery without terminating the entire play.

Answer

The rescue tasks run, and then the entire playbook fails.

Answer

The rescue tasks are ignored and the play fails immediately.

Answer

The block is re-executed after rescue.

Question 11

A team uses a single Ansible Tower inventory called 'Production' containing hosts for multiple environments (dev, stage, prod). They want to apply different variables to hosts based on environment. Which inventory structure meets this requirement with minimal administrative overhead?

Accepted Answer

Create groups within the inventory for each environment (e.g., 'dev', 'stage', 'prod') and assign variables at the group level.. Ansible Tower (now Red Hat Ansible Automation Platform) supports group-based variable inheritance within a single inventory. By creating groups for each environment (dev, stage, prod) and assigning variables at the group level, you can apply environment-specific variables to all hosts in that group with minimal administrative overhead. This leverages Tower's built-in group variable mechanism without requiring per-host edits or multiple inventory objects.

Answer

Assign variables directly to each host using the 'Host Variables' field in the inventory.

Answer

Add tags to each host and use the tags to filter variables in the job template.

Answer

Create separate inventories for each environment and link them to the same project.

Question 12

An OpenShift rolling update is failing because new pods crash immediately. Which parameter automatically triggers a rollback if no progress is made?

Accepted Answer

progressDeadlineSeconds. The `progressDeadlineSeconds` parameter specifies the maximum duration (in seconds) that a deployment can make no progress before it is considered to have failed. When this deadline is exceeded, the deployment controller automatically triggers a rollback to the previous revision. This is the correct parameter for automatically rolling back a failed rolling update where new pods crash immediately.

Answer

revisionHistoryLimit

Answer

maxSurge

Answer

maxUnavailable

Answer

minReadySeconds

Question 13

Drag and drop the steps to configure a container using Podman with a custom Dockerfile in the correct order.

Accepted Answer

Create a Dockerfile, then build the image using podman build, then list images using podman images, then run the container using podman run, then verify the container is running using podman ps.. Podman workflow: create Dockerfile, build image, list images, run container, verify.

Answer

Build the image using podman build, then create a Dockerfile, then run the container using podman run, then list images using podman images, then verify the container is running using podman ps.

Answer

Create a Dockerfile, then list images using podman images, then build the image using podman build, then run the container using podman run, then verify the container is running using podman ps.

Answer

Run the container using podman run, then create a Dockerfile, then build the image using podman build, then list images using podman images, then verify the container is running using podman ps.

Question 14

A team develops a custom Ansible role 'webserver' that depends on another role 'common'. They want to ensure that when 'webserver' is used, 'common' is automatically installed from the same Galaxy server. Which approach should they use?

Accepted Answer

Add a dependencies: ['common'] to the role's meta/main.yml file.. Ansible roles can declare dependencies in the `meta/main.yml` file using the `dependencies` key. When the 'webserver' role is installed via `ansible-galaxy install`, Ansible automatically resolves and installs all listed dependencies from the same Galaxy server, ensuring 'common' is present without manual intervention.

Answer

Add a requirements.yml file in the role's root directory specifying common.

Answer

Use ansible-galaxy install webserver --with-dependencies to install common separately.

Answer

Include the 'common' role in the playbook before 'webserver'.

Question 15

A playbook includes a long-running task that should not block the rest of the playbook. The administrator wants to start the task and later check its status. Which method should be used?

Accepted Answer

Use the 'async' keyword with 'poll: 0' and then use async_status module.. Setting `poll: 0` with the `async` keyword launches the task in the background without waiting for it to complete, and the `async_status` module can then be used later to check the task's status by referencing its job ID. This allows the playbook to continue executing other tasks while the long-running task runs asynchronously.

Answer

Use 'delegate_to: localhost' and 'run_once'.

Answer

Use a separate playbook invoked with 'ansible-playbook' via command module.

Answer

Use 'throttle' to limit execution.