EX294 Practice Test 15 — 15 Questions

Question 1

A systems administrator is performing a rolling update of a three-node Red Hat Enterprise Linux 8 cluster running a load-balanced web application. The update involves upgrading the httpd package. The administrator uses Ansible to update one node at a time. After updating the first node, the administrator checks the application health and finds that the node is serving requests correctly. The administrator proceeds to update the second node. However, after the second node update completes, the load balancer reports that both the first and second nodes are unavailable. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The second node's update triggered a configuration change that disabled the health check endpoint on both nodes.. The rolling update of the second node could have triggered a configuration change (e.g., via a shared configuration file or package update) that affected the health check endpoint on both the first and second nodes. This would explain why both nodes became unavailable after the second node update. Option A is wrong since a segmentation fault in httpd would likely only affect the node where it occurs and is not automatically triggered by an update on another node. Option B is incorrect because if the first node were excluded from the load balancer pool, it would have been unavailable immediately after its own update, not after the second node update. Option C is wrong because load balancers are typically configured to allow multiple active nodes; restricting to one node is uncommon and would not explain sudden unavailability of both nodes.

Answer

The httpd service on both nodes experienced a segmentation fault after the update.

Answer

The first node was inadvertently excluded from the load balancer pool by the Ansible playbook.

Answer

The load balancer was configured to only allow one node to be active at a time.

Question 2

Drag and drop the steps to configure a firewall rule using firewalld to allow HTTPS traffic in the correct order.

Accepted Answer

Step 1: Check the current default zone. Step 2: Add the HTTPS service permanently using --permanent. Step 3: Reload firewalld. Step 4: Verify the rule is active. Step 5: Test connectivity.. Firewalld commands: check zone, add service with --permanent, reload, verify, test.

Answer

Step 1: Add the HTTPS service without --permanent. Step 2: Reload firewalld. Step 3: Verify the rule. Step 4: Test connectivity.

Answer

Step 1: Add the HTTPS service with --permanent. Step 2: Verify the rule without reloading. Step 3: Reload firewalld. Step 4: Test connectivity.

Answer

Step 1: Reload firewalld. Step 2: Add the HTTPS service with --permanent. Step 3: Verify the rule. Step 4: Test connectivity.

Question 3

Match each systemd unit type to its description.

Accepted Answer

service: Manages a system service (daemon). Common systemd unit types include service (manages daemons), socket (manages IPC/network sockets), timer (schedules events), and mount (controls mount points). Be careful not to confuse timer with service.

Answer

service: Triggers activation of other units based on time

Answer

timer: Manages a system service

Question 4

Which TWO filters can be used to conditionally select elements from a list based on a test? (Select exactly two.)

Accepted Answer

reject. In Ansible, the `reject` filter removes elements from a list that match a given condition, effectively selecting only those that do not match. The `select` filter does the opposite: it keeps elements that match the condition. Both are used for conditional selection from a list based on a test, making C and D correct.

Answer

map

Answer

combine

Answer

flatten

Question 5

In an Ansible playbook, the 'strategy' parameter is set to 'free'. What behavior does this strategy produce?

Accepted Answer

Each host runs through the playbook independently of other hosts.. The 'free' strategy in Ansible allows each host to run through the playbook independently, without waiting for other hosts to finish the current task. This means a faster host can proceed to subsequent tasks while slower hosts are still working on earlier tasks, maximizing parallelism and reducing overall execution time.

Answer

Playbook runs tasks on hosts in batches of 1.

Answer

Strategy is deprecated and replaced by 'linear'.

Answer

All hosts run the same task at the same time, then move to the next task.

Question 6

A playbook uses import_playbook to include other playbooks. The main playbook is run with --check mode. Which statement is true?

Accepted Answer

Imported playbooks are also run in check mode.. When a playbook uses `import_playbook`, the imported playbooks are statically included at parse time, meaning they become part of the main playbook's play structure. The `--check` mode flag applies to the entire playbook execution, so all imported playbooks also run in check mode. Option D is correct because Ansible propagates the check mode flag to all imported plays.

Answer

Only the main playbook runs in check mode; imported ones run normally.

Answer

All imported playbooks are skipped because import happens at parse time.

Answer

import_playbook does not support check mode.

Question 7

A playbook uses 'delegate_to: localhost' for a task that modifies a local file. The playbook runs against multiple servers. The administrator notices that the local file is overwritten by each parallel execution, causing corruption. Which strategy should be used to prevent this?

Accepted Answer

Use 'run_once: true' along with 'delegate_to'.. `run_once: true` ensures that the task executes only once across the entire batch of hosts, even when `delegate_to: localhost` is used. This prevents the local file from being overwritten by multiple parallel executions, as the task runs on a single host (the first in the inventory) and delegates the file modification to localhost once.

Answer

Increase 'forks: 1' to serialize execution.

Answer

Use 'throttle: 1' on the task.

Answer

Use 'serial: 1' at the play level.

Question 8

An automation engineer wants to run a playbook only on hosts that belong to both the 'webservers' group and the 'production' group. Which inventory grouping method achieves this?

Accepted Answer

webservers:&production. In Ansible, the '&' operator is used to intersect groups. 'webservers:&production' targets hosts that are in both the 'webservers' and 'production' groups. Option B is wrong because 'webservers:production' uses ':' which is a union operator, meaning hosts in either group. Option C is wrong because 'webservers:!production' uses '!' to exclude hosts in production. Option D is wrong because 'webservers+,production' is not a valid inventory pattern; Ansible does not support '+' for group intersection.

Answer

webservers:production

Answer

webservers:!production

Answer

webservers+,production

Question 9

You need to run an Ansible playbook every hour to update a dynamic inventory file from a CMDB API. The playbook is stored in /opt/ansible/update_inventory.yml. You want to schedule the execution using a cron job on the control node. The control node runs Red Hat Enterprise Linux 9. The playbook uses Ansible Vault to decrypt API credentials, and the vault password is stored in /etc/ansible/.vault_pass. Which cron entry will execute the playbook hourly?

Accepted Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml. It specifies the correct cron schedule (0 * * * * for hourly), uses the correct command (ansible-playbook), and points to the correct vault password file (/etc/ansible/.vault_pass) as specified in the stem. Option A uses the wrong vault password file path (~/.vault_pass). Option B uses the wrong schedule (every minute). Option C uses the wrong command (ansible instead of ansible-playbook).

Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file ~/.vault_pass /opt/ansible/update_inventory.yml

Answer

* * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Answer

0 * * * * /usr/bin/ansible --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Question 10

You are responsible for managing a large fleet of web servers running Red Hat Enterprise Linux 8. You have an Ansible playbook that deploys a custom web application. The playbook uses several roles from Ansible Galaxy and includes tasks that require root privileges. Recently, users reported that the deployment fails intermittently with the error 'Timeout (12s) waiting for privilege escalation prompt'. You suspect that the issue is related to the become method and the SSH connection. The current inventory uses 'ansible_user: deploy' and 'ansible_become: yes' with default settings. The 'deploy' user has sudo privileges with NOPASSWD for all commands. However, the timeout occurs only on high-latency connections. Which change would most effectively resolve the timeout issue?

Accepted Answer

Set ansible_become_timeout to a higher value in the inventory.. The error 'Timeout (12s) waiting for privilege escalation prompt' is specifically about the become timeout, not the general SSH timeout. The correct fix is to increase the become timeout by setting 'ansible_become_timeout' to a higher value in the inventory or playbook. Option D correctly increases this timeout. Option A (forks) only affects parallelism. Option B (pipelining) reduces SSH round trips but does not change the become timeout. Option C (become password) is unnecessary because the user already has NOPASSWD sudo access.

Answer

Increase 'forks' to 20 to run more tasks in parallel.

Answer

Enable pipelining by setting 'pipelining = True' in ansible.cfg.

Answer

Set 'ansible_become_password' in the inventory.

Question 11

Your team manages a large Ansible Tower environment with multiple organizations. Each organization has its own projects, inventories, and job templates. You need to create a set of cloud credentials (AWS access key) that can be used by any job template in any organization, but you want to restrict modification of the credential to only a few administrators. What is the best way to achieve this while maintaining flexibility?

Accepted Answer

Create a single credential in the global 'Default' organization and use Tower's RBAC to grant read access to all users and admin access to a few.. Ansible Tower's RBAC allows you to create a single credential in the global 'Default' organization and then assign read permissions to all users (allowing them to use the credential in job templates) while restricting admin (write/modify) access to a few administrators. This approach maintains flexibility by making the credential available across all organizations without duplication or manual synchronization.

Answer

Store the access key in an external secrets management vault and reference it via an encrypted file in the project.

Answer

Create a separate credential in each organization and synchronize the keys manually.

Answer

Create a custom credential type that all users create their own instance of.

Question 12

A company is deploying Red Hat Ansible Automation Platform 2.3 in a hybrid cloud environment. The automation controller is installed on a RHEL 8 server in the on-premises data center. Execution nodes are distributed: four in the same data center, two in a remote branch office connected via VPN, and three in AWS EC2 instances. The VPN connection to the branch office is low-bandwidth and high-latency. The AWS nodes use a direct connect with stable bandwidth. During initial testing, playbooks running on the branch office execution nodes frequently timeout or hang, while on-premises and AWS nodes work fine. The automation mesh topology is configured with all nodes as direct children of the controller. The team wants to minimize latency and ensure reliable execution for the branch office nodes. Which course of action should the administrator take?

Accepted Answer

Deploy an additional automation mesh node in the branch office and make the branch office execution nodes children of that node.. Deploying an additional automation mesh node in the branch office creates a local parent for the branch office execution nodes, reducing the number of high-latency, low-bandwidth VPN hops between the controller and those nodes. In the automation mesh, parent-child relationships allow execution nodes to connect through a closer intermediary, minimizing timeouts and improving reliability by keeping control-plane traffic local.

Answer

Configure the controller to use the AWS execution nodes for all branch office jobs via a proxy.

Answer

Increase the `ansible_timeout` setting in the controller configuration to 120 seconds.

Answer

Reduce the forks value for branch office execution nodes to 1.

Question 13

An Ansible playbook needs to parse a JSON output from a REST API and extract the value of a nested key "data.settings.timeout". The output is stored in the variable "api_result". Which filter should be used to safely extract the value, with a default of 30 if the key is missing or the JSON is malformed?

Accepted Answer

{{ api_result | json_query('data.settings.timeout') | default(30) }}. `json_query` uses JMESPath syntax to query nested JSON structures, and `data.settings.timeout` is a valid JMESPath expression for extracting the value at that nested key. The `default(30)` filter provides a fallback if the key is missing or the JSON is malformed, ensuring safe extraction.

Answer

{{ api_result | combine({'data.settings.timeout': 30}) }}

Answer

{{ api_result | selectattr('data.settings.timeout') | first | default(30) }}

Answer

{{ api_result | dict2items | selectattr('key', 'equalto', 'data.settings.timeout') | map(attribute='value') | first | default(30) }}

Question 14

A team uses `ansible-navigator` to run playbooks with an execution environment. The playbook requires a collection that is not included in the execution environment. Which approach allows the team to use the collection without rebuilding the execution environment?

Accepted Answer

Set the `ANSIBLE_COLLECTIONS_PATHS` environment variable to a directory containing the collection and use `--execution-environment-image` with the EE.. Setting the `ANSIBLE_COLLECTIONS_PATHS` environment variable tells `ansible-navigator` to look for collections in a specified directory on the host, and using `--execution-environment-image` ensures the correct execution environment image is used. This allows the team to inject a collection into the container at runtime without modifying the execution environment image itself, as `ansible-navigator` mounts the specified host directory into the container automatically.

Answer

Use the `--container-options` flag to mount a volume with the collection.

Answer

Use `ansible-galaxy collection install` inside the execution environment at runtime.

Answer

Rebuild the execution environment with the collection included.

Question 15

A system administrator is managing Ansible Tower and wants to use an Azure Resource Manager credential to provision virtual machines. However, the credential fails authentication with the error '401 Unauthorized'. Which action should the administrator take to resolve the issue?

Accepted Answer

Verify the client secret in the credential matches the one configured in Azure Active Directory.. The 401 Unauthorized error when using an Azure Resource Manager credential in Ansible Tower indicates that the authentication token or secret used to authenticate with Azure Active Directory is invalid or mismatched. Option B is correct because verifying that the client secret stored in the Tower credential exactly matches the one configured in Azure Active Directory resolves the authentication failure, as Azure AD uses OAuth 2.0 client credentials flow where the client secret is required for token acquisition.

Answer

Regenerate the SSH key pair and update the credential.

Answer

Add the credential as a playbook-level variable instead of a Tower credential.

Answer

Generate a new API token from Azure and paste it into the credential.