EX294 Practice Test 17 — 15 Questions

Question 1

A developer wants to encrypt a string in a playbook variable file. Which command should they use?

Accepted Answer

ansible-vault encrypt_string. `ansible-vault encrypt_string` is specifically designed to encrypt a single string value for use in a playbook variable file, without encrypting the entire file. This command outputs the encrypted string in a format that can be directly pasted into a YAML variable definition, preserving the rest of the file as plaintext.

Answer

ansible-vault rekey

Answer

ansible-vault create

Answer

ansible-vault edit

Question 2

Ansible Builder fails during the build of an execution environment with error: 'No matching manifest for linux/amd64 in the manifest list entries'. What is the most likely cause?

Accepted Answer

The base image specified is incompatible with the host architecture.. The error 'No matching manifest for linux/amd64 in the manifest list entries' indicates that the base image specified in the execution environment definition file does not have a container image manifest for the host's CPU architecture (linux/amd64). Ansible Builder pulls the base image from a registry, and if that image only supports other architectures (e.g., linux/arm64), the build fails. This is a common issue when using a base image built for a different platform.

Answer

The ansible-builder version is too old.

Answer

The definition file has invalid syntax.

Answer

The container registry requires authentication.

Question 3

An Ansible playbook that deploys a web application includes a task that uses the `uri` module to call an external API. The task occasionally fails due to API rate limiting. Which combination of keywords should be added to the task to automatically retry up to 5 times with a 30-second delay between attempts, and only fail if all retries are exhausted?

Accepted Answer

`register: result`, `until: result.status == 200`, `retries: 5`, `delay: 30`. It combines `register` to capture the API response, `until` to check that `result.status` equals 200 (the HTTP success code), `retries: 5` to attempt the task up to five times, and `delay: 30` to wait 30 seconds between retries. This ensures the task only fails after all five retries are exhausted, which is the exact behavior needed to handle transient API rate limiting.

Answer

`register: result`, `until: status == 200`, `retries: 5`, `delay: 30`

Answer

`until: result.status == 200`, `retries: 5`, `delay: 30`

Answer

`register: result`, `retries: 5`, `delay: 30`

Question 4

Which THREE of the following are valid Ansible lookup plugins? (Select exactly three.)

Accepted Answer

`csvfile`. `csvfile` is a built-in Ansible lookup plugin that reads data from CSV files, allowing playbooks to parse structured tabular data. It is documented in the official Ansible lookup plugin list and is commonly used for dynamic inventory or configuration values.

Answer

`map`

Answer

`select`

Question 5

An organization is deploying Automation Platform for the first time. The security team requires that all SSH private keys used for automation be stored securely with access controls. Which AAP feature should be used to meet this requirement?

Accepted Answer

Create a Machine credential type and upload the SSH private key.. The Machine credential type in Ansible Automation Platform (AAP) is specifically designed to securely store SSH private keys. When you upload the private key via the AAP web UI or API, it is encrypted at rest in the AAP database and access is controlled through role-based access control (RBAC). This meets the security team's requirement for secure storage and access controls without exposing the key in plain text.

Answer

Store the private key in plain text within the inventory file.

Answer

Use Ansible Vault to encrypt the private key file.

Answer

Set the SSH key as an environment variable on the controller.

Question 6

An Ansible playbook uses async and poll to run a long-running task. The task reports 'async task did not complete within the requested time'. Which of the following is the most likely cause?

Accepted Answer

the async timeout value is set too short for the task duration. The error 'async task did not complete within the requested time' indicates that the async timeout value (set via the async parameter) is too short for the actual task duration. The poll interval does not affect the timeout; it only controls how often Ansible checks the task status. Option B is correct because increasing the async value allows the task more time to complete.

Answer

the poll interval is set too long

Answer

the async task requires become: yes

Answer

the host is unreachable

Question 7

Refer to the exhibit. What is the output of the debug task?

Accepted Answer

192.168.1.10. The `debug` task in Ansible uses the `msg` parameter to display the value of a variable. In the exhibit, the variable `ansible_default_ipv4.address` is referenced, which returns the IPv4 address of the default network interface. Since the host's default interface is eth0 with IP 192.168.1.10, the debug output is that IP address. Option D correctly shows the output as '192.168.1.10'.

Answer

10.0.0.5

Answer

[ '192.168.1.10' ]

Answer

eth0

Question 8

Which TWO factors should be considered when choosing a base container image for an execution environment?

Accepted Answer

The presence of ansible-core and ansible-runner.. Option B is correct because an execution environment must contain ansible-core and ansible-runner to actually execute Ansible playbooks and roles; without these packages the image cannot function as an automation execution environment. Option D is correct because the base operating system version determines package availability, supported Python versions, and compatibility with the ansible-core and collection dependencies you install, so it must be chosen deliberately. Option A is not a primary selection factor because a recent update date alone does not guarantee the required Ansible tooling or OS compatibility. Option C is not a primary factor because image size affects pull time and storage but does not determine whether the environment can run Ansible content. Option E is not a primary factor because the number of layers is an optimization detail, not a functional requirement for an execution environment.

Answer

The date of the last update.

Answer

The size of the image.

Answer

The number of layers.

Question 9

A playbook uses a loop over a list of packages to ensure they are installed. However, the playbook runs slowly because each package is processed individually. Which optimization technique should be used to improve performance?

Accepted Answer

Pass the entire list to the package module's 'name' parameter instead of looping.. Ansible's package modules (such as yum, apt, or dnf) accept a list of packages in the 'name' parameter. Passing the entire list in a single task eliminates the overhead of multiple task executions, SSH connection reuse, and module setup/teardown that occur with each iteration in a loop. This reduces the number of Ansible task runs from N to 1, significantly improving performance.

Answer

Use with_items instead of loop; with_items is faster.

Answer

Set the async parameter on the looped task to run packages in parallel.

Answer

Use the serial keyword at the play level to increase parallelism.

Question 10

A security team requires that all passwords in an Ansible vault be encrypted with a different key from the host variables. They want to use a custom lookup plugin that fetches secrets from an external API. Which plugin type should be developed?

Accepted Answer

Lookup plugin. A lookup plugin is the correct choice because it is designed to retrieve data from external sources (like an API) and return it as a string or list for use in Ansible playbooks. This aligns with the requirement to fetch secrets from an external API, and lookup plugins can be used directly in variables or templates without modifying the host state.

Answer

Module

Answer

Action plugin

Answer

Filter plugin

Question 11

You are managing a web application deployment using Ansible. The application requires a specific version of a library (libapp) to be installed on all web servers. Your current playbook uses the role 'web' which includes a task to install libapp version 1.2. However, after a recent update, the role's defaults now specify libapp version 2.0, but you must keep version 1.2 for compatibility. You have defined a variable 'lib_version' in the playbook's vars section with value '1.2'. The role's task uses the variable 'libapp_version' (not 'lib_version'). The play fails because 'libapp_version' is undefined. What is the best way to resolve this issue without modifying the role?

Accepted Answer

Use the playbook to set libapp_version as a variable for the role: either in the play vars section or by passing it as a role parameter.. It allows you to set the variable `libapp_version` that the role expects without modifying the role itself. By defining `libapp_version` in the playbook's vars section or passing it as a role parameter, you override the role's default value (2.0) with the required version 1.2, ensuring the task uses the correct library version while preserving role integrity.

Answer

Modify the role's defaults/main.yml to set libapp_version to 1.2.

Answer

Rename your playbook variable from lib_version to libapp_version in the play vars.

Answer

Create a file roles/web/vars/main.yml with libapp_version: 1.2.

Question 12

An organization has a set of common tasks used in many playbooks. The tasks are updated frequently. What is the most maintainable way to share them?

Accepted Answer

Package the tasks into a collection and install it via ansible-galaxy.. Ansible Collections provide a centralized, versioned, and distributable way to package and share tasks, roles, modules, and plugins. Using `ansible-galaxy collection install` allows teams to manage updates from a single source (e.g., Automation Hub or a private Galaxy server), ensuring all playbooks use the latest version without manual file copying or path dependencies.

Answer

Create a role and store it in a local directory referenced by ansible.cfg.

Answer

Copy the task files into each project repository.

Answer

Use include_tasks with a relative path from each playbook.

Question 13

An Ansible playbook is used to generate configuration files for network devices. The variables are defined in a vars file like:
---
interfaces:
  - name: GigabitEthernet1
    ip: 192.168.1.1/24
  - name: GigabitEthernet2
    ip: 10.0.0.1/24

The playbook uses a Jinja2 template to render the config. The template iterates over interfaces and writes "ip address" lines. However, the designer wants to support an additional field "secondary_ips" which is a list of IP addresses (e.g., ["192.168.2.1/24", "192.168.3.1/24"]). In the template, they want to generate multiple "ip address" lines for each interface, one for the primary IP and one for each secondary IP. The following template fragment is used:
{% for iface in interfaces %}
interface {{ iface.name }}
 ip address {{ iface.ip }}
{% for sec in iface.secondary_ips|default([]) %}
 ip address {{ sec }}
{% endfor %}
{% endfor %}

This works when secondary_ips is defined. However, some interfaces have secondary_ips defined as a string (e.g., "192.168.2.1/24") instead of a list. The playbook fails because the inner loop tries to iterate over a string. The engineer wants to normalize the data in the playbook before passing to the template, so that secondary_ips is always a list. Which of the following set_fact tasks will correctly transform the interfaces list to ensure secondary_ips is always a list (even if missing or a string)?

Accepted Answer

- set_fact:
    interfaces: "{{ interfaces | map('combine', {'secondary_ips': (item.secondary_ips is undefined or item.secondary_ips is none) | ternary([], (item.secondary_ips is string) | ternary(item.secondary_ips | split(','), item.secondary_ips))}) }}"
  loop: "{{ interfaces }}". Ly uses the `ternary` filter to handle three cases: when `secondary_ips` is undefined or None (returns an empty list), when it is a string (splits it into a list), and when it is already a list (returns it unchanged). This ensures the template always receives a list for iteration, preventing the 'iteration over string' error.

Answer

- set_fact:
    interfaces: "{{ interfaces | map('combine', {'secondary_ips': item.secondary_ips | default([]) | split(',') if item.secondary_ips is defined and item.secondary_ips is string else item.secondary_ips | default([])}) }}"
  loop: "{{ interfaces }}"

Answer

- set_fact:
    interfaces: "{{ interfaces | map('combine', {'secondary_ips': [item.secondary_ips | default('')] | flatten }) }}"
  loop: "{{ interfaces }}"

Answer

- set_fact:
    interfaces: "{{ interfaces | map('combine', {'secondary_ips': item.secondary_ips | default([]) | string | split(',') | list}) }}"
  loop: "{{ interfaces }}"

Question 14

A team uses Ansible to update a database cluster with one primary and two replicas. The goal is zero downtime. Which update order is the safest?

Accepted Answer

Update replicas first, then the primary.. Updating replicas first ensures that if the update introduces a regression, it affects only the read-only replicas, which can be quickly rolled back without impacting write availability. Once replicas are confirmed healthy, the primary is updated and a controlled failover (e.g., using `patronictl switchover` or `repmgr standby switchover`) promotes a replica to primary, minimizing downtime to seconds. This order aligns with the principle of reducing blast radius and maintaining quorum in a cluster.

Answer

Update in random order.

Answer

Update all nodes simultaneously.

Answer

Update the primary first, then replicas.

Question 15

Refer to the exhibit. A playbook includes this vars file and runs `systemctl restart httpd`. The playbook fails because it cannot decrypt the vault. Which of the following is the most likely cause?

Accepted Answer

The vault password is not provided.. The error 'cannot decrypt the vault' indicates that Ansible is unable to decrypt the vault-encrypted variable file. This occurs when the vault password is not provided via `--ask-vault-pass`, `--vault-password-file`, or the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable. Without the correct password, Ansible cannot decrypt the vault, causing the playbook to fail.

Answer

The vault ID is missing.

Answer

The variable db_password is not used in the playbook.

Answer

The vault file is corrupted.