EX294 Practice Test 17 — 15 Questions

Question 1

Match each SELinux context component to its meaning.

Question 2

Match each Ansible module to its primary function.

Question 3

Match each Ansible fact variable to its description.

Question 4

Match each Ansible inventory parameter to its meaning.

Question 5

Match each Linux file system path to its typical content.

Question 6

A managed node is configured with an Ansible vault-encrypted variable file. When running a playbook that uses these variables, the user receives a 'decryption failed' error. Which two steps should the user take to resolve the issue?

Accepted Answer

Ensure the vault ID matches the one used when encrypting the file.. Option D is correct because Ansible vault supports multiple vault IDs (labels) to manage different passwords for different encrypted files. If the vault ID used during decryption does not match the one used when encrypting the file, Ansible will fail to decrypt it, even if the correct password is provided. The `--vault-id` option or `ANSIBLE_VAULT_ID_MATCH` environment variable must align the ID with the encryption context.

Answer

Verify the file permissions are set to 600.

Answer

Check that the SSH private key has access to the managed node.

Answer

Make sure the vault password file contains the path to the vault file.

Question 7

Refer to the exhibit. When the playbook runs on target1, which value will nginx_port have in the role?

Accepted Answer

9090 (from host vars). Ansible variable precedence: host vars > playbook vars > role vars (vars/main.yml) > role defaults. Playbook vars override role vars, but host vars override playbook vars. Since the inventory sets nginx_port: 9090 for target1, that value takes precedence.

Answer

443 (from playbook vars)

Answer

8080 (from vars/main.yml)

Answer

80 (from defaults/main.yml)

Question 8

Refer to the exhibit. A playbook fails with the above error when using ansible-vault. What is the most likely cause?

Accepted Answer

The vault id used in the playbook does not match the one used to encrypt the file.. The error specifically mentions vault id 'default', indicating that the file was encrypted with a different vault id or the password for the default id is wrong. The most common cause is a mismatch between the vault id used in the playbook and the one used to encrypt the file.

Answer

The file is not encrypted with ansible-vault.

Answer

The vault password file is missing.

Answer

The user does not have read permissions on the file.

Question 9

Which TWO are valid ways to restrict access to job templates in Automation Controller?

Accepted Answer

Use credential types with separate permissions. Assigning RBAC roles to teams and using credential types with separate permissions are both valid methods to control access to job templates. Tags filter tasks within playbooks, not access. Inventory source filters determine dynamic inventory hosts. Scheduling sets execution time, not permissions.

Answer

Use tags in playbooks

Answer

Set job template to 'run at specific times'

Answer

Use inventory source filters

Question 10

A DevOps team maintains an Ansible environment using execution environments. They have been using a local execution environment image named 'custom-ee:latest' built with ansible-builder. Recently, they updated the requirements.yml file to include a new collection from Automation Hub. They rebuilt the execution environment using ansible-builder and pushed it to their private registry as 'registry.internal/custom-ee:1.2'. However, when running ansible-navigator on a control node, it still uses the old local image and does not pull the updated one. The ansible-navigator configuration file (ansible-navigator.yml) specifies:

execution-environment:
  image: registry.internal/custom-ee:1.2
  enabled: true
  pull:
    policy: tag

The control node has no prior local image with that tag. What is the most likely reason the new image is not being used?

Accepted Answer

An environment variable such as ANSIBLE_NAVIGATOR_EXECUTION_ENVIRONMENT_IMAGE overrides the configuration file, pointing to the old image.. Option C is correct because environment variables override settings in ansible-navigator.yml. The ANSIBLE_NAVIGATOR_EXECUTION_ENVIRONMENT_IMAGE variable likely points to the old image tag. Option A is incorrect because 'tag' policy would pull if the tag differs from local, but no local image exists so it should pull. Option B is a possible cause but would result in a pull failure, not using the old image. Option D is unlikely as the image was pushed with the correct tag.

Answer

The control node does not have network access to the registry, so it cannot pull the image and falls back to the local 'latest' image.

Answer

The pull policy 'tag' only pulls if the local image tag differs from the registry tag, and since the local image is 'latest', it compares to '1.2' and pulls, but something else prevents it.

Answer

The image was rebuilt with a different tag than '1.2', so the registry does not have that tag.

Question 11

A junior admin runs the command shown in the exhibit. What is the most likely cause of the error?

Accepted Answer

The playbook uses incorrect YAML syntax; the task should use the 'module' keyword.. Option B is correct. The YAML syntax is incorrect because the 'ansible.builtin.shell' module should be listed under the 'module' key, not as a separate line. The correct usage is 'ansible.builtin.shell:' as a value under 'module:' or directly as the action. In this case, the task is missing the 'module' key. Option A is wrong because the collection is installed by default. Option C is wrong because the syntax error is in the YAML structure, not in the module name. Option D is wrong because the path is absolute and correct.

Answer

The 'ansible.builtin' collection is not installed in the execution environment.

Answer

The shell module requires a command argument that is missing.

Answer

The playbook file path is incorrect; ansible-navigator cannot find the file.

Question 12

Which TWO statements are true about deploying Red Hat Ansible Automation Platform on a Red Hat Enterprise Linux 8 system?

Accepted Answer

The AAP installer uses an Ansible playbook named 'ansible-setup.yml' to perform the installation.. Options A and D are correct. A: The setup playbook is used to deploy AAP components. D: Automation controller and private automation hub can be installed on separate nodes for scalability. B is incorrect because subscription-manager attach is not required if using local repos. C is incorrect because postgreSQL must be separate from the controller node in a standard installation. E is incorrect because the installer creates the admin user based on the inventory file.

Answer

The installer automatically creates an admin user with a randomly generated password.

Answer

The automation controller and database must be installed on the same node for performance reasons.

Answer

Before installation, you must attach a subscription using subscription-manager attach --pool=...

Question 13

An administrator needs to create a custom execution environment that includes a specific Ansible collection and a Python package. Which two steps are required to build and use the execution environment? (Choose two.)

Accepted Answer

Build the execution environment using ansible-builder.. Options A and C are correct. Creating a requirements.yml with the collection (A) and then building the execution environment with ansible-builder (C) are required. Option B is not needed because ansible-builder uses a definition file, not a Dockerfile directly. Option D is optional for sharing but not required to use locally. Option E is wrong because execution environment is configured in ansible-navigator config, not ansible.cfg.

Answer

Create a Dockerfile that installs the collection and package.

Answer

Define the execution environment in ansible.cfg.

Answer

Push the execution environment to a private container registry.

Question 14

Refer to the exhibit. An Ansible user runs `ansible-navigator` from the `/home/user/project` directory. The execution environment image is not present locally. What will occur?

Accepted Answer

The image will be pulled from the registry because the pull policy is 'missing'.. Option A is correct because the pull policy "missing" means the image will be pulled if not present locally. Option B is incorrect because the pull policy is set in the config, not requiring CLI flags. Option C is incorrect because podman is a valid container engine in ansible-navigator. Option D is incorrect because the source path `/home/user/project` is absolute.

Answer

The container engine will default to docker because podman is not a valid engine.

Answer

The volume mount will fail because the source path is not absolute.

Answer

The image will be pulled only if the --pull flag is passed on the CLI.

Question 15

The playbook above fails with an error. What is the most likely cause?

Accepted Answer

The `match` test requires a regex pattern as an argument.. The `match` test requires a regex pattern as an argument. The correct syntax is `select('match', 'pattern')`. Without a pattern, Ansible raises an error. Option A is incorrect because quotes around the test name are fine. Option C is incorrect because `select` works on lists and does not need `selectattr` for simple matching. Option D is incorrect because there is no 'filter' plugin used here.

Answer

The `select` filter must be used with `selectattr` for attributes.

Answer

The `select` filter requires the test name without quotes.

Answer

The `filter` plugin should be used instead of `select`.