EX294 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. The playbook fails with an error. What is the most likely cause?

Accepted Answer

import_tasks cannot be used with a loop.. `import_tasks` is a static import that is processed at playbook parse time, before any variables or loops are evaluated. Ansible does not support using `import_tasks` inside a loop (`loop:` or `with_items:`) because the import occurs once during parsing, not dynamically per iteration. To run tasks repeatedly, you must use `include_tasks`, which is processed dynamically at runtime and supports loops.

Answer

import_tasks must be placed in a role.

Answer

The loop variable should be referenced as '{{ item }}' without quotes.

Answer

The file names must be literal without templates.

Question 2

Match each systemd unit type to its description.

Accepted Answer

service: Manages a system service (daemon). Common systemd unit types include service (manages daemons), socket (manages IPC/network sockets), timer (schedules events), and mount (controls mount points). Be careful not to confuse timer with service.

Answer

service: Triggers activation of other units based on time

Answer

timer: Manages a system service

Question 3

An administrator wants to update a web server fleet with minimal downtime. They need to update each server one at a time. Which Ansible playbook directive should be used?

Accepted Answer

serial: 1. The `serial: 1` directive in an Ansible playbook controls the batch size of hosts that are updated simultaneously. Setting it to 1 ensures that only one host is updated at a time, which minimizes downtime by allowing the rest of the fleet to remain available while each server is sequentially updated.

Answer

throttle: 1

Answer

forks: 1

Answer

max_fail_percentage: 0

Question 4

Which TWO of the following are correct about Ansible Vault?

Accepted Answer

the vault password can be provided via the '--vault-password-file' option. The `--vault-password-file` option allows Ansible to read the vault password from a file, which is a standard method for providing the password non-interactively, especially in automation scripts or CI/CD pipelines. This avoids the need for manual password entry and supports secure password management.

Answer

vault encryption is irreversible

Answer

vault encrypted files cannot be edited in place

Answer

vault can encrypt only specific variable values within a file

Question 5

Refer to the exhibit. A developer builds an execution environment using this execution-environment.yml. After building, the container starts but ansible-navigator cannot connect to the container because the required SSH packages are missing. Which file most likely needs to be updated?

Accepted Answer

bindep.txt. D is correct because `bindep.txt` specifies system-level package dependencies (like `openssh-clients` or `sshpass`) that must be installed in the container image. When building an execution environment, `ansible-builder` reads `bindep.txt` to install RPM packages via `dnf` (or `apt` on Debian-based images). If SSH packages are missing, the `bindep.txt` file is the most likely place to add them, as it directly controls which system packages are included in the final image.

Answer

The base image itself

Answer

requirements.yml

Answer

requirements.txt

Question 6

Which TWO actions are required to use a private Automation Hub to share collections?

Accepted Answer

Configure the server in ansible.cfg under [galaxy] server_list.. Option A is correct because to make the ansible-galaxy client talk to a private Automation Hub instead of the default galaxy.ansible.com, you must list that server under the [galaxy] server_list setting in ansible.cfg (or via the ANSIBLE_GALAXY_SERVER_LIST environment variable), which defines the server name and URL used for collection operations. Option E is correct because private Automation Hub requires authentication for publishing and often for downloading collections, so you must generate an API token in the Automation Hub UI and supply it via the token key under the server's section in ansible.cfg or through the corresponding environment variable (e.g., ANSIBLE_GALAXY_SERVER_<name>_TOKEN). Option B is not required because building a custom execution environment is an optional packaging/distribution approach, not a prerequisite for the client to share collections with a private hub. Option C is not required because --ignore-certs is only a workaround for certificate validation failures with self-signed certificates and is not part of the standard configuration for using a private Automation Hub. Option D is not required because --pull-policy missing is an ansible-navigator execution-environment behavior and has nothing to do with configuring a private Automation Hub as a collection source.

Answer

Build a custom execution environment that includes the collections.

Answer

Run ansible-galaxy collection install --ignore-certs if using self-signed certs.

Answer

Use ansible-navigator with --pull-policy missing.

Question 7

Which TWO statements about Ansible collections are correct?

Accepted Answer

Collections provide a way to package and distribute Ansible content.. Option B is correct because Ansible collections are the standard packaging format for distributing Ansible content, bundling modules, roles, plugins, playbooks, and documentation into a single installable unit that can be shared via namespaces. Option E is correct because collections can be published to and installed from public Ansible Galaxy or Red Hat Automation Hub (and private Automation Hub), typically using commands like 'ansible-galaxy collection install' with a namespace.collection name. Option A is incorrect because collections are versioned using semantic versioning (e.g., 1.2.0) in their galaxy.yml and requirements files. Option C is incorrect because inventory files define managed hosts and remain necessary; collections do not replace them. Option D is incorrect because collections can contain many content types beyond modules and roles, including plugins, module utilities, and documentation.

Answer

Collections cannot be versioned.

Answer

Collections replace the need for inventory files.

Answer

Collections can only contain modules and roles.

Question 8

A playbook uses an Ansible collection that includes a custom module. The module's documentation is missing. What is the best way to locate the module's source code?

Accepted Answer

Navigate to the collection's plugin directory on the control node.. Ansible collections store custom modules in the 'plugins/modules' directory within the collection's installation path on the control node. Navigating to that directory allows you to view the module's source code directly, which is the most reliable way to locate it when documentation is missing.

Answer

Run ansible-doc <module name>.

Answer

Search the Ansible Galaxy website.

Answer

Look in the roles directory.

Question 9

A junior admin is troubleshooting why a job template fails with 'Permission denied' when connecting to a target host. The job template uses a machine credential that appears correct. What is the first thing to check?

Accepted Answer

Check the credential's username and private key / password. The error 'Permission denied' during SSH connection to a target host indicates an authentication failure. Since the machine credential appears correct, the most immediate cause is that the username or private key/password stored in the credential is incorrect or mismatched. This is the first thing to check because the credential directly controls authentication to the target host.

Answer

Verify the inventory contains the correct host IP

Answer

Check the vault credential used in the job template

Answer

Check the project sync status

Question 10

A company uses Ansible Tower and has defined a custom inventory script. The inventory returns JSON with nested groups. The playbook needs to list all hosts from a specific group 'webservers' that are not in the 'drain' subgroup. Which combination of filters correctly extracts these hosts?

Accepted Answer

{{ groups['webservers'] | difference(groups['drain']) }}. The `difference` filter in Ansible returns the elements of the first list that are not present in the second list. This directly matches the requirement: all hosts in the 'webservers' group that are not in the 'drain' subgroup.

Answer

{{ groups['webservers'] | symmetric_difference(groups['drain']) }}

Answer

Answer

Question 11

Your organization is migrating from manually maintained control nodes to using execution environments. You have created an execution environment that includes all necessary collections and Python dependencies. You want to ensure that developers use this execution environment when running playbooks. You have configured ansible-navigator on their workstations. However, some developers report that when they run a playbook, it uses the local installation of Ansible instead of the execution environment. What should you check first?

Accepted Answer

Ensure that the developers are using the 'ansible-navigator run' command instead of 'ansible-playbook'.. `ansible-navigator` is the CLI tool designed to run Ansible inside an execution environment. If developers run `ansible-playbook` directly, it uses the locally installed Ansible, bypassing the execution environment entirely. The question states that `ansible-navigator` is configured on their workstations, but the developers must use the `ansible-navigator run` subcommand to invoke playbooks within the containerized environment.

Answer

Confirm that the developers have installed ansible-builder locally.

Answer

Verify that the ansible-navigator configuration file points to the correct execution environment image.

Answer

Check that the execution environment container is running on the developers' machines.

Question 12

An Ansible Engineer is planning a rolling update for a web application deployed across 10 nodes. The playbook uses the 'delegate_to' directive to manage load balancer health checks. Which of the following best describes the recommended approach to minimize downtime?

Accepted Answer

Use 'serial: 1' and delegate load balancer disable/enable tasks to localhost, ensuring each node is taken out of rotation before updating.. Using 'serial: 1' ensures that only one node is updated at a time, and delegating load balancer disable/enable tasks to localhost (or the Ansible control node) allows the playbook to interact with the load balancer API to remove the node from the pool before the update and re-add it after. This minimizes downtime by ensuring traffic is not sent to a node being updated, while other nodes continue serving requests.

Answer

Run the update playbook with 'serial: 10' to update all nodes at once, then run a separate playbook to update the load balancer.

Answer

Run the update on each node manually using 'ansible-playbook --limit' and skip load balancer management to save time.

Answer

Use 'strategy: free' to allow nodes to update independently without controlling the load balancer.

Question 13

The playbook uses the community.general.parse_csv filter. Assuming the collection is installed, what is the type and structure of the 'parsed' variable?

Accepted Answer

A list of dictionaries: [{'name': 'Alice', 'age': '30'}, {'name': 'Bob', 'age': '25'}]. The `community.general.parse_csv` filter in Ansible parses CSV content into a list of dictionaries, where the first row is treated as headers and subsequent rows become dictionaries with those headers as keys. Option A correctly describes this output: a list of dictionaries with keys 'name' and 'age' and corresponding string values.

Answer

A single string: 'Alice,30
Bob,25'

Answer

A list of strings: ['name,age', 'Alice,30', 'Bob,25']

Answer

A dictionary: {'Alice': '30', 'Bob': '25'}

Question 14

An Ansible automation team is designing a playbook to manage network devices. They need to ensure that the playbook can handle transient network failures by retrying failed tasks a specific number of times with a delay between retries. Which approach should they use?

Accepted Answer

Use the `until` loop with `retries` and `delay` parameters on the task.. The `until` loop with `retries` and `delay` parameters is the correct approach because it allows a task to be retried a specified number of times with a configurable pause between attempts, directly addressing transient network failures. This is a built-in Ansible feature for handling intermittent issues without additional error-handling constructs.

Answer

Set `max_fail_percentage` in the play to 0 and use `ignore_errors: yes` with a rescue block.

Answer

Use the `throttle` keyword to limit concurrent tasks and rely on idempotency.

Answer

Set `serial: 1` on the play to ensure only one host is processed at a time and rely on idempotency.

Question 15

An admin imports this inventory into AAP and assigns a machine credential that uses SSH key authentication. The job fails with 'Authentication failed'. What is the most likely cause?

Accepted Answer

The machine credential does not contain an SSH private key.. In Red Hat Ansible Automation Platform (AAP), when a machine credential is assigned to a host, that credential's SSH key is used for authentication. If the credential does not contain an SSH private key, authentication will fail. Credentials take precedence over inventory variables such as ansible_ssh_private_key_file, so a conflict is not the likely cause. Therefore, the most likely cause is that the machine credential is missing its SSH private key.

Answer

The private key file path in the inventory does not exist on the controller.

Answer

The credential's SSH key is not being used because the inventory variable ansible_ssh_private_key_file conflicts.

Answer

The 'ansible_become' variable is missing from the inventory.