EX294 Practice Test 17 — 15 Questions

Question 1

Which TWO of the following are correct about Ansible Vault?

Accepted Answer

the vault password can be provided via the '--vault-password-file' option. The `--vault-password-file` option allows Ansible to read the vault password from a file, which is a standard method for providing the password non-interactively, especially in automation scripts or CI/CD pipelines. This avoids the need for manual password entry and supports secure password management.

Answer

vault encryption is irreversible

Answer

vault encrypted files cannot be edited in place

Answer

vault can encrypt only specific variable values within a file

Question 2

An administrator is managing an Ansible Automation Platform deployment that runs job templates against a dynamic inventory sourced from VMware vCenter. The administrator updated the vCenter credentials in Tower after a password rotation. However, subsequent inventory syncs continue to fail with authentication errors. The administrator has confirmed that the new credentials work when tested directly on the controller node using the 'govc' CLI tool. The inventory source is configured to use the updated credential and the update_on_launch flag is set to true. Which action should the administrator take to resolve the issue?

Accepted Answer

Run the inventory sync with the 'Clear Cache' option enabled.. The inventory sync might be using cached credentials or data, and clearing the cache forces a fresh sync that uses the updated credentials. Option A is incorrect because recreating the credential is unnecessary; the existing credential is valid and works when tested. Option B is incorrect because restarting the ansible-tower service is not a targeted solution and may not clear the inventory cache. Option D is incorrect because changing the inventory source name and reconfiguring it is overkill and does not directly address the caching issue.

Answer

Recreate the credential and assign it to the inventory source again.

Answer

Restart the ansible-tower service.

Answer

Change the inventory source to use a new name and reconfigure it.

Question 3

Which THREE are valid uses of lookup plugins in Ansible? (Select exactly three.)

Accepted Answer

Generate a random MAC address using `password` lookup with `mac` parameter. The `password` lookup plugin supports the `mac` parameter to generate a random MAC address. Option B is correct because the `password` lookup plugin is used to generate random passwords. Option D is correct because the `ini` lookup plugin retrieves values from INI files. Option C is incorrect: the `pipe` lookup plugin executes a command locally on the control node, not on the remote host. Option E is incorrect because the `file` lookup plugin reads the contents of a file from the control node, but it is not considered one of the three valid uses in this context.

Answer

Execute a command on the remote host using `pipe` lookup

Answer

Read the contents of a file using `file` lookup

Question 4

Which THREE of the following are best practices for managing credentials in Ansible Automation Controller?

Accepted Answer

Restrict credential 'Use' permissions to specific users or teams. Ansible Automation Controller's Role-Based Access Control (RBAC) allows administrators to assign granular 'Use' permissions to specific users or teams, ensuring that only authorized entities can leverage a credential for job runs. This prevents unauthorized access to sensitive secrets and aligns with the principle of least privilege, which is a core security best practice in automation environments.

Answer

Avoid using external secret management systems; keep all secrets in Automation Controller

Answer

Share the same credential across multiple organizations for simplicity

Question 5

You are an automation engineer at a large enterprise. The company uses Ansible Automation Platform 2.x and has a private Automation Hub server. The security team mandates that all execution environments must be built from a hardened base image that has been approved by the security team. The base image is stored in a private container registry at registry.internal.company.com/hardened-ee:latest. You need to create an execution environment that includes a custom collection 'company.tools' which is hosted on the private Automation Hub. Additionally, the execution environment must include the Python library 'cryptography' version 3.4.8. You have created the following files:

execution-environment.yml:
---
version: 3
images:
  base_image:
    name: registry.internal.company.com/hardened-ee:latest
options:
  package_manager_path: /usr/bin/microdnf
dependencies:
  galaxy: requirements.yml
  python: requirements.txt

requirements.yml:
---
collections:
  - name: company.tools
    source: https://automationhub.company.com/api/galaxy/content/private/

requirements.txt:
cryptography==3.4.8

When you run 'ansible-builder build -f execution-environment.yml', the build fails with an error: 'Error: Failed to resolve dependency cryptography==3.4.8'. Based on this scenario, what is the most likely cause of the failure?

Accepted Answer

The base image already includes cryptography but not version 3.4.8, causing a version conflict.. The error 'Failed to resolve dependency cryptography==3.4.8' indicates a version conflict with the Python cryptography library already present in the hardened base image. The base image likely includes a different version of cryptography, and pip cannot satisfy the pinned version constraint due to conflicts with the pre-installed package. Ansible Builder uses pip to install Python dependencies, and if the base image has a conflicting version, the build fails unless the dependency is unpinned or the base image is adjusted.

Answer

The requirements.yml file has an incorrect source URL for the private Automation Hub.

Answer

The execution-environment.yml is missing the 'system' dependency section for bindep.txt.

Answer

The package_manager_path should be /usr/bin/dnf instead of microdnf.

Question 6

A playbook fails with 'ERROR! 'become' is not a valid attribute for a Play'. What is the most likely cause?

Accepted Answer

The playbook uses an older syntax that requires 'sudo'. In older versions of Ansible (prior to 2.0), privilege escalation was handled using the 'sudo' keyword at the play level. The error 'become' is not a valid attribute for a Play' indicates that the playbook is using the modern 'become' directive at the play level, but the installed Ansible version (likely 1.x) does not support it. The correct syntax for that version would be 'sudo: yes'.

Answer

The playbook lacks a hosts line

Answer

The become directive is misspelled

Answer

become is allowed only in tasks, not plays

Question 7

Refer to the exhibit. The playbook runs successfully. What will the debug task output?

Accepted Answer

A dictionary with details about the user, such as uid, gid, and groups.. The debug task outputs the registered variable from the user module. By default, the user module returns a dictionary containing user account details such as uid, gid, groups, and home directory when the state is 'present'. Since the playbook runs successfully, the registered variable holds this dictionary, making option B correct.

Answer

Just the username 'jdoe'.

Answer

The entire playbook YAML structure.

Answer

The string 'true' if the user was created successfully.

Question 8

An execution environment is built using ansible-builder. The definition file includes a base image from registry.redhat.io. After building, the container runs but ansible-navigator can't find the EE. What is the most likely cause?

Accepted Answer

The EE was not pushed to a registry accessible by ansible-navigator.. The most likely cause is that the execution environment (EE) was built locally but not pushed to a registry that `ansible-navigator` can access. By default, `ansible-navigator` pulls EEs from a container registry (e.g., `registry.redhat.io` or a private registry) specified in its configuration; it does not automatically discover locally built images. If the EE is only present in the local Docker/Podman store, `ansible-navigator` will fail to find it, resulting in a runtime error.

Answer

ansible-navigator uses a different Python interpreter.

Answer

The base image is not compatible with the installed collections.

Answer

The EE was not tagged correctly.

Question 9

An organization uses Ansible Tower to manage automation across different teams. One team has a job template that uses a custom Python virtual environment located at '/opt/custom_venv' to run a playbook that uses the 'docker_container' module from the 'community.docker' collection. The playbook runs successfully from the command line when using the '--ask-become-pass' option and the virtual environment activated. However, when the team runs the same playbook via the Ansible Tower job template, it fails with an error indicating that the 'docker_container' module is not found. The job template is configured to use the custom virtual environment under the 'CUSTOM VIRTUAL ENVIRONMENT' setting. The team confirms that the virtual environment has the collection installed (verified by running 'ansible-galaxy collection list' inside the venv). What is the most likely cause of the failure?

Accepted Answer

The Ansible Tower node executing the job does not have the custom virtual environment installed.. The most likely cause is that the Ansible Tower node executing the job does not have the custom virtual environment installed (Option B). Even though the job template is configured to use the custom virtual environment at '/opt/custom_venv', Tower runs jobs on its own execution nodes (or the node specified in the job template's execution environment). If that node does not have the custom virtual environment installed, it will fail to find the 'community.docker' collection. Option A is incorrect because 'ansible_connection: local' does not affect collection availability. Option C is incorrect because the team verified the collection is installed in the custom venv. Option D is incorrect because the question states the job template uses the correct path; the failure is due to the node lacking the venv entirely.

Answer

The playbook should use the 'ansible_connection: local' directive to force local execution.

Answer

The 'community.docker' collection was installed in the default system-wide location instead of the custom virtual environment.

Answer

The job template's 'CUSTOM VIRTUAL ENVIRONMENT' setting points to a different path than '/opt/custom_venv'.

Question 10

An automation controller administrator must ensure that a playbook's output does not expose sensitive data. Which TWO actions should be taken? (Choose exactly two.)

Accepted Answer

Set 'no_log: true' on tasks that handle sensitive data.. Only Option A is valid. Setting 'no_log: true' on sensitive tasks prevents Ansible from printing task arguments and output to the console or log files, ensuring that sensitive information like passwords or API keys are not exposed. Option D references 'display_args_to_stdout = false', which is not a valid Ansible configuration option and does not exist. Therefore, only one action is correct.

Answer

Set 'stdout_callback = actionable' in ansible.cfg.

Answer

Use 'name: "Sensitive task"' but keep the task body visible.

Answer

Add 'display_args_to_stdout = false' to the execution environment's ansible.cfg.

Answer

Use 'tags: never' on sensitive tasks.

Question 11

An Ansible Tower/AWX job template uses a custom inventory script that dynamically queries an API. The script returns JSON including groups and hosts. Recently, the API started returning HTTP 500 errors intermittently, causing inventory sync failures. Which Ansible approach can make the inventory source more resilient?

Accepted Answer

Configure the inventory script to use the Ansible cache plugin with a timeout and fallback to cached data.. The Ansible cache plugin can store the results of a dynamic inventory script and serve them when the API is unavailable. By configuring a timeout and fallback to cached data, the job template avoids failures during transient HTTP 500 errors, ensuring inventory sync resilience without modifying the script itself.

Answer

Wrap the inventory script invocation in a Jinja2 template with error handling.

Answer

Use the setup module to gather facts and store them locally as a fallback inventory.

Answer

Modify the inventory script to retry on failure and write results to a static file.

Question 12

An Ansible playbook uses async and poll to run a long-running task. The task reports 'async task did not complete within the requested time'. Which of the following is the most likely cause?

Accepted Answer

the async timeout value is set too short for the task duration. The error 'async task did not complete within the requested time' indicates that the async timeout value (set via the async parameter) is too short for the actual task duration. The poll interval does not affect the timeout; it only controls how often Ansible checks the task status. Option B is correct because increasing the async value allows the task more time to complete.

Answer

the poll interval is set too long

Answer

the async task requires become: yes

Answer

the host is unreachable

Question 13

A playbook must execute cleanup tasks after a block of tasks, both on success and failure. Which two of the following should be used within the block to achieve this?

Accepted Answer

always. To execute cleanup tasks after a block regardless of success or failure, use the block keyword to group the main tasks and the always keyword to define tasks that run unconditionally. The block + always pattern ensures cleanup runs even if the block fails. The other options do not achieve this: ignore_errors only prevents failures from stopping execution, rescue handles failures but only after a failure, and failed_when customizes failure conditions but does not guarantee cleanup execution.

Answer

ignore_errors

Answer

rescue

Answer

failed_when

Question 14

Which TWO conditions are necessary for the 'local_action' directive to work as intended?

Accepted Answer

The task must be executed on the Ansible control node.. Options C and E are correct. For the 'local_action' directive to work as intended, the task must be executed on the Ansible control node (C) because local_action delegates the task to localhost. Additionally, the connection plugin must be set to 'local' (E) because local_action uses the local connection plugin to run commands on the control node without SSH. Option A is incorrect because local_action does not require an inventory entry for the control node; it implicitly uses localhost. Option B is incorrect because privilege escalation (become) is not a requirement for local_action; it can be used independently. Option D is incorrect because local_action is a shorthand directive, not a module; it is used instead of the 'action' keyword with delegate_to: localhost, but the key is that it runs locally with the local connection.

Answer

The inventory must contain an entry for the control node.

Answer

The task must have privilege escalation (become) enabled.

Answer

The 'local_action' module must be used instead of 'action'.

Question 15

An Ansible playbook uses the 'constructed' inventory plugin with 'keyed_groups' to create groups based on 'ansible_distribution'. Despite correct configuration, hosts are not assigned to the expected groups. What is the most likely cause?

Accepted Answer

the 'strict' option is set to 'yes' and the required facts are not gathered. 'strict: yes' causes plugin to fail on undefined variables; if facts are not gathered, 'ansible_distribution' is undefined. Options A, B, D are plausible but less likely.

Answer

the 'keyed_groups' syntax uses invalid Jinja2 expressions

Answer

the inventory file is incorrectly formatted

Answer

the plugin is not enabled in ansible.cfg