EX294 Practice Test 16 — 15 Questions

Question 1

Which TWO of the following are best practices when coordinating rolling updates with Ansible?

Accepted Answer

Define a 'max_fail_percentage' to abort the update if too many hosts fail.. 'max_fail_percentage' allows you to define a threshold of host failures (as a percentage of the batch size) that, when exceeded, causes Ansible to abort the entire rolling update. This prevents the update from continuing when too many hosts have failed, which could lead to an inconsistent or degraded state across the infrastructure. Option B is correct because the 'serial' keyword controls the number of hosts (or percentage) that Ansible updates in each batch, ensuring that only a subset of hosts is taken out of service at a time, which maintains overall service availability during the rolling update.

Answer

Use 'strategy: free' to allow hosts to run tasks independently.

Answer

Use 'gather_facts: no' to speed up the playbook.

Answer

Set 'any_errors_fatal: true' to stop the update on the first failure.

Question 2

A company uses Ansible Automation Platform and wants to ensure that all playbook runs are logged for audit purposes. What is the simplest way to achieve centralized logging of job runs?

Accepted Answer

Configure the syslog server in the automation controller settings.. Automation Controller (formerly Ansible Tower) has a built-in setting under 'System → Logging' where you can configure a syslog server (e.g., using RFC 5424). Once configured, all job runs, playbook output, and audit events are automatically forwarded to that central syslog server without modifying any playbooks or adding custom callbacks. This is the simplest, most centralized, and most maintainable approach for audit logging.

Answer

Use the logging module in each playbook to write to a central syslog.

Answer

Add a playbook callback that sends output to a file on each node.

Answer

Enable verbose logging in the inventory file.

Question 3

A playbook includes multiple roles. The administrator wants to skip a specific role during execution. Which technique should they use?

Accepted Answer

Use tags on the role and run with --skip-tags. Ansible roles support tagging, and the `--skip-tags` option allows you to exclude all tasks within a role that share a specific tag. By assigning a unique tag to the role (e.g., `tags: skip_me`) and running the playbook with `--skip-tags skip_me`, the entire role is skipped without modifying individual tasks or hosts.

Answer

Add a condition to each task in the role

Answer

Use the '--limit' option to exclude hosts

Answer

Use tags on the role and run with --tags

Question 4

A developer has created a collection and needs to publish it to a private Automation Hub. Which command should be used to upload the collection archive?

Accepted Answer

`ansible-galaxy collection publish ./my-namespace-my_collection-1.0.0.tar.gz`. The correct command to upload a collection archive to a private Automation Hub is `ansible-galaxy collection publish ./my-namespace-my_collection-1.0.0.tar.gz`. This command authenticates to the configured Automation Hub server (as defined in `ansible.cfg` or the `--server` flag) and publishes the tarball, making it available for other users to install. The `publish` subcommand is specifically designed for this purpose, handling the API call to the Galaxy or Automation Hub server.

Answer

`ansible-galaxy collection server upload ./tar.gz`

Answer

`ansible-galaxy role import my-namespace my_collection`

Answer

`ansible-galaxy collection upload ./my-namespace-my_collection-1.0.0.tar.gz`

Question 5

Which TWO statements are true about deploying Red Hat Ansible Automation Platform on a Red Hat Enterprise Linux 8 system?

Accepted Answer

The AAP installer uses an Ansible playbook named 'ansible-setup.yml' to perform the installation.. The correct answers are C and D. C is correct because the Red Hat Ansible Automation Platform installer is executed via an Ansible playbook named 'ansible-setup.yml' (or the setup.sh script that runs it). D is correct because automation controller and private automation hub are separate components that can be installed on different nodes to distribute the workload and improve scalability. Option A is incorrect because the admin user password is specified in the inventory file, not randomly generated. Option B is incorrect because in production environments, the database is typically installed on a separate node for performance and reliability. Option E is incorrect: while a valid subscription is required, attaching via subscription-manager is not mandatory; the installer can use local repositories or other subscription methods.

Answer

The installer automatically creates an admin user with a randomly generated password.

Answer

The automation controller and database must be installed on the same node for performance reasons.

Answer

Before installation, you must attach a subscription using subscription-manager attach --pool=...

Question 6

An Ansible content creator wants to ensure that a collection is properly structured and meets Red Hat's best practices. Which TWO of the following are required files in a valid Ansible collection structure?

Accepted Answer

meta/runtime.yml. A is correct because `meta/runtime.yml` is a required file in a valid Ansible collection structure. It defines the collection's runtime dependencies, such as minimum Ansible version and action group mappings, ensuring the collection is compatible with the Ansible runtime environment. B is correct because `galaxy.yml` is the mandatory metadata file that describes the collection's name, version, authors, and other essential information, and it is required for publishing to Ansible Galaxy or Automation Hub.

Answer

plugins/README.md

Answer

requirements.yml

Answer

roles/requirements.yml

Question 7

A company has a large infrastructure with over 1000 servers. They run a playbook that configures NTP on all servers. The playbook takes over 30 minutes due to sequential execution. The team wants to reduce execution time. Which approach should they take?

Accepted Answer

Set forks: 50 and strategy: free.. Increasing forks and using free strategy maximizes parallelism. Option A (serial) still processes batches sequentially. Option C (ansible-pull) shifts the workload but may not be faster. Option D (include_tasks) does not affect parallelism.

Answer

Use serial: 10 to batch hosts.

Answer

Use include_tasks to parallelize tasks.

Answer

Use ansible-pull on each server.

Question 8

A role contains a handler. The playbook includes the role and also defines a task that notifies the same handler. When the playbook runs, the handler executes only once. Which of the following best explains this behavior?

Accepted Answer

handlers are deduplicated by name; multiple notifications trigger the handler only once per play. Ansible handlers are deduplicated by name within a play. When a handler is notified multiple times—whether from a role or a playbook task—it runs only once at the end of the play, after all tasks have completed. This prevents redundant executions and is a core design feature of Ansible's handler system.

Answer

the handler was already triggered by the role and is skipped for the play task

Answer

the role's handler uses 'listen' which overrides notifications

Answer

the playbook's task notifies a different handler with the same name

Question 9

A company manages its infrastructure using Ansible Tower. There are two teams: Team Alpha manages web servers in the 'webservers' group, and Team Beta manages database servers in the 'dbservers' group. Both teams need to use the same SSH credential to connect to their respective servers. The credential is stored in Tower as 'shared_ssh_key'. Team Alpha reports that they can launch jobs against the 'webservers' group, but Team Beta gets an error when trying to launch jobs against the 'dbservers' group: 'You do not have permission to use this credential.' Both teams are members of the same organization. The inventory is a single inventory source with separate groups. The credential has been assigned to the organization. What is the most likely cause of Team Beta's issue, and what is the correct solution?

Accepted Answer

Grant Team Beta the 'Use' role on the credential 'shared_ssh_key'.. In Ansible Tower, credentials are assigned to an organization, but users or teams must be explicitly granted the 'Use' role on a credential to be able to use it in a job template. Team Alpha can use the credential because they likely have the 'Use' role, while Team Beta does not. Granting Team Beta the 'Use' role on 'shared_ssh_key' resolves the permission error.

Answer

Create a new credential with the same SSH key and assign it to Team Beta.

Answer

Assign the credential to the dbservers group in the inventory.

Answer

Move the credential from the organization to the project level.

Question 10

An administrator is designing a role that needs to execute a set of tasks conditionally based on whether a package is installed. Which approach is best practice?

Accepted Answer

Use the package_facts module. The `package_facts` module is the best practice for gathering package installation status in Ansible. It populates the `ansible_facts.packages` variable with structured data about installed packages, allowing you to conditionally execute tasks using `when` statements without relying on external commands or file checks. This approach is idempotent, efficient, and aligns with Ansible's declarative philosophy.

Answer

Use the stat module to check package file existence

Answer

Use the command module to check package status

Answer

Use ansible_facts.packages

Question 11

An administrator needs to apply a set of firewall rules to multiple servers. They have created a playbook that uses the firewalld module. When running the playbook, they receive 'ERROR! module not found: firewalld'. The control node has the module available locally. What is the most likely cause?

Accepted Answer

The ansible.posix collection is not installed on the control node.. Error 'module not found: firewalld' indicates the module is not accessible. The firewalld module belongs to the ansible.posix collection, which must be installed on the control node (e.g., via 'ansible-galaxy collection install ansible.posix'). Option B is correct because the missing collection is the most likely cause. Option A is incorrect because 'firewalld' is the valid module name. Option C is possible but less likely than a missing collection. Option D is incorrect because modules execute on the control node, not target nodes.

Answer

The playbook uses the wrong module name.

Answer

The ansible.cfg has a wrong module path.

Answer

The module is not installed on the target nodes.

Question 12

After upgrading AAP, an admin notices that all job templates using a custom virtual environment fail with 'No module named 'foo''. The virtual environment was previously working. What should the admin do first?

Accepted Answer

Recreate the custom virtual environment and reinstall the 'foo' package.. After an AAP upgrade, custom virtual environments are not automatically migrated or preserved; they must be recreated and their packages reinstalled. The 'No module named 'foo'' error indicates that the Python environment no longer contains the required package, so recreating the environment and reinstalling 'foo' is the correct first step to restore functionality.

Answer

Switch the job template to use an execution environment instead.

Answer

Reassign the job template to the default virtual environment.

Answer

Verify that the credential associated with the job template is valid.

Question 13

A systems administrator needs to run a playbook that applies configuration changes to a set of servers. They want to ensure that if any task fails on a host, the playbook continues with the next host without aborting the entire play. Which play-level keyword should they use?

Accepted Answer

`ignore_errors: yes` on each task that might fail.. `ignore_errors: yes` on each task ensures that if a task fails on a host, the playbook continues executing subsequent tasks on that host and moves on to the next host without aborting the entire play. This directly meets the requirement to continue with the next host upon task failure.

Answer

Set `gather_facts: no` to skip fact gathering and reduce failure points.

Answer

Set `any_errors_fatal: true` at the play level.

Answer

Set `force_handlers: true` at the play level.

Question 14

An administrator needs to combine two dictionaries, `base_config` and `user_config`, where keys in `user_config` should override keys in `base_config`, and nested dictionaries should be merged recursively. Which filter syntax achieves this?

Accepted Answer

{{ base_config | combine(user_config, recursive=True) }}. The `combine` filter in Ansible with `recursive=True` merges two dictionaries, with `user_config` overriding `base_config`, and recursively merges nested dictionaries. This matches the requirement exactly, as `recursive=True` ensures that nested structures are combined rather than replaced outright.

Answer

Answer

Answer

Question 15

Refer to the exhibit. The playbook runs successfully, but the service is not restarted. What is the most likely cause?

Accepted Answer

The template did not result in a change to the destination file. The handler is not notified because the template task might not have changed the file.

Answer

The handler name has a typo: 'restart app' vs 'restart app'

Answer

The systemd module requires ansible_user to be root

Answer

The template source file does not exist