EX294 Practice Test 18 — 15 Questions

Question 1

An Ansible automation engineer is writing a playbook to configure network devices. They need to extract specific data from a JSON structure returned by an API call. Which two filters from the `ansible.utils` collection can be used to manipulate the data?

Accepted Answer

ipaddr. The `ipaddr` filter from `ansible.utils` is used to manipulate IP addresses, and the `zip` filter from `ansible.utils` is used to combine lists element-wise. The `json_query` filter belongs to `community.general`, not `ansible.utils`. The `to_json` and `from_json` filters are part of `ansible.builtin`, not `ansible.utils`.

Answer

to_json

Answer

json_query

Answer

from_json

Question 2

An administrator is configuring Ansible Tower for a multi-environment deployment. The team has separate Azure service principals for dev, test, and prod, and uses Ansible Vault to encrypt sensitive variables. Which TWO configuration practices ensure secure credential management and clear inventory separation?

Accepted Answer

Create a single inventory and assign all hosts to groups named dev, test, and prod, then apply credentials at the group level.. Option A is correct because using a single inventory with groups for each environment and assigning credentials at the group level is a best practice for organizing inventories. Option D is correct because defining separate credential types for each environment with unique Vault IDs ensures secure isolation of secrets. Option B is incorrect because using a single credential with overrides defeats the purpose of credential separation and is hard to manage. Option C is incorrect because storing vault passwords in files on the controller is less secure than using Vault IDs. Option E is incorrect because using the same vault password for all environments reduces security.

Answer

Use the same vault password and vault ID for all environments to simplify management.

Answer

Use a single credential of type 'Azure Service Principal' and manually override the secrets per job template.

Answer

Store the vault password in a file on the Tower server and reference it by path.

Question 3

What is the most likely cause of the failure?

Accepted Answer

The credential type is incorrect; it should be a Source Control credential, not Machine.. Option B is correct because the credential type must match the service; a Machine credential is used for SSH/WinRM, not for source control. Using a Source Control credential ensures proper authentication for the SCM project. Option A is incorrect because source_path can be a file or directory; the error is authentication-related. Option C is incorrect because update_cache_timeout=0 is valid (no caching). Option D is incorrect because source_project can accept either name or ID. Option E is incorrect because source 'scm' is valid for sourcing inventory from a project.

Answer

The inventory must be of type 'file' rather than 'scm'.

Answer

The source_path is incorrect because it should be a directory, not a file.

Answer

The source_project should reference the project ID, not name.

Answer

The update_cache_timeout should be a positive integer.

Question 4

A company uses Ansible to perform a rolling update of 10 web servers behind an HAProxy load balancer. The playbook uses the `serial` keyword and includes tasks to disable a host from the load balancer, update the web server package, and re-enable the host. Which TWO best practices should the administrator apply to minimize downtime and ensure a successful rolling update?

Accepted Answer

Set `serial: 1` to update one host at a time.. Option A is correct because setting `serial: 1` updates one host at a time, ensuring that at most one host is out of the pool, preserving capacity. Option D is correct because ensuring the load balancer draining timeout is longer than the update time prevents the host from being prematurely re-enabled before the update completes. Option B is wrong because `any_errors_fatal: true` would stop the entire update on the first failure, which is too aggressive for a rolling update where failures on individual hosts can be tolerated. Option C is wrong because `throttle: 1` limits concurrency of a single task across hosts, but does not control batch size; it can coexist with `serial` but is not a best practice for rolling update orchestration. Option E is wrong because `async` and `poll` are used for long-running tasks that should run in the background, not for sequential batch updates.

Answer

Use `any_errors_fatal: true` to stop the playbook if any host fails.

Answer

Use `throttle: 1` to limit the number of concurrent tasks across all hosts.

Answer

Use `async` and `poll` to run the update tasks in the background while proceeding to the next host immediately.

Question 5

An administrator runs this playbook against a group of 10 web servers. The update fails on the third host (host3) due to a yum error. What is the most likely outcome?

Accepted Answer

The playbook continues with the remaining hosts because the number of failures (1) is below the 25% threshold.. Option D is correct because `max_fail_percentage: 25` allows up to 25% of hosts to fail before aborting. With 10 hosts, 2 failures are allowed (25% of 10 = 2.5, so 2 failures). After host3 fails, only 1 failure has occurred (host3), which is below the threshold, so the playbook continues with the remaining batches. Option A is wrong because only host3's disable/enable tasks would be affected; the playbook does not disable all hosts. Option B is wrong because `max_fail_percentage` prevents immediate halt unless the failure threshold is exceeded. Option C is wrong because the first batch (hosts 1-2) completes successfully, but the playbook continues to the next batch (hosts 3-4), and even though host3 fails, host4 may still be updated (unless it also fails).

Answer

Only the first batch (host1 and host2) are updated successfully; the remaining hosts are skipped.

Answer

All hosts are disabled in HAProxy and the playbook fails.

Answer

The playbook halts immediately after the failure on host3.

Question 6

Which TWO of the following statements about Ansible roles are correct?

Accepted Answer

Variables in 'defaults/main.yml' have the lowest precedence and can be overridden by inventory variables.. Variables in defaults/main.yml have the lowest precedence and can be overridden by inventory variables. Role dependencies are defined in meta/main.yml. The other options are incorrect: pre_tasks run before roles, include_role is dynamic, and the naming convention is not mandatory.

Answer

Role names must be prefixed with 'ansible-role-' when published to Ansible Galaxy.

Answer

The 'include_role' module can only be used for static imports.

Answer

A role's tasks are executed before any 'pre_tasks' defined in the playbook.

Question 7

A team is automating server configuration using Ansible. They have a custom role 'security' that updates firewall and SSH settings. They notice that when they apply the role to multiple hosts, the SSH configuration changes sometimes fail because the firewall blocks the SSH port before the SSH configuration is updated. They need to ensure that SSH configuration is updated first, then firewall rules are applied. They have defined both tasks in the same role. What should they do?

Accepted Answer

Split the role into two separate roles and use role dependencies to enforce order.. The best approach is to split the role into two separate roles and use role dependencies to enforce order. Role dependencies, defined in meta/main.yml, allow specifying that one role must run before another. By creating a 'ssh_config' role and a 'firewall' role, and setting the firewall role to depend on the ssh_config role, the correct order is guaranteed. Option B is invalid (no 'order' directive). Tags do not control task order within a role. Pre_tasks/post_tasks are play-level constructs and do not apply to role-internal order.

Answer

Use tags to control the sequence of tasks.

Answer

Use pre_tasks for SSH and post_tasks for firewall in the playbook.

Answer

Use the 'order' directive in the playbook to specify task order within the role.

Question 8

Refer to the exhibit. An administrator runs the playbook but the wait_for task fails. What is the most likely cause?

Accepted Answer

The ansible_facts variable may not be available because fact gathering is disabled.. The wait_for task uses ansible_facts, which are not gathered by default unless fact gathering is enabled. Since there is no gather_facts directive or it is set to false, ansible_facts will be empty, causing the task to fail. Option B is correct. Option A is incorrect because delegate_to is fine on localhost. Option C is incorrect because http_port is defined. Option D is incorrect because wait_for accepts strings for port.

Answer

The http_port variable is misspelled.

Answer

The wait_for module requires the 'port' parameter to be an integer.

Answer

The delegate_to should be set to the remote host.

Question 9

Refer to the exhibit. The playbook runs successfully. What will the debug task output?

Accepted Answer

A dictionary with details about the user, such as uid, gid, and groups.. The debug task outputs the registered variable from the user module. By default, the user module returns a dictionary containing user account details such as uid, gid, groups, and home directory when the state is 'present'. Since the playbook runs successfully, the registered variable holds this dictionary, making option B correct.

Answer

Just the username 'jdoe'.

Answer

The entire playbook YAML structure.

Answer

The string 'true' if the user was created successfully.

Question 10

Which TWO factors should be considered when choosing a base container image for an execution environment?

Accepted Answer

The presence of ansible-core and ansible-runner.. An execution environment is a container image that includes all dependencies needed to run Ansible automation. For it to function correctly, the base image must contain `ansible-core` and `ansible-runner`, as these provide the core automation engine and the runner that manages playbook execution, respectively. Without these components, the container cannot execute Ansible jobs, making their presence a mandatory requirement.

Answer

The date of the last update.

Answer

The size of the image.

Answer

The number of layers.

Question 11

Refer to the exhibit. A user runs ansible-runner with --container-image localhost/ee-30:latest and receives the error shown. What is the most likely cause?

Accepted Answer

The container image has not been pulled or built locally.. The error indicates that the container image `localhost/ee-30:latest` is not available locally. The `--container-image` flag tells ansible-runner to use a specific execution environment image, but if that image has not been pulled from a registry or built locally, the container runtime (e.g., Podman or Docker) cannot find it. Option D is correct because the image must exist in the local container storage before ansible-runner can launch it.

Answer

The container image tag is incorrect.

Answer

The ansible-runner process does not have network access.

Answer

The execution environment is not listed in the project's execution-environment.yml.

Question 12

Refer to the exhibit. A user attempts to download the collection using the download URL but the signature verification fails. What is the most likely reason?

Accepted Answer

The user's client does not have the corresponding public key.. B is correct because signature verification of a downloaded collection requires the client to have the corresponding public key that was used to sign the collection. If the user's client lacks this public key, the verification process will fail, even if the collection itself is properly signed and the URL is valid.

Answer

The collection version does not match.

Answer

The collection is not properly signed.

Answer

The download URL is invalid.

Question 13

An Ansible playbook that deploys a web application includes a task that uses the `uri` module to call an external API. The task occasionally fails due to API rate limiting. Which combination of keywords should be added to the task to automatically retry up to 5 times with a 30-second delay between attempts, and only fail if all retries are exhausted?

Accepted Answer

`register: result`, `until: result.status == 200`, `retries: 5`, `delay: 30`. Option B is correct because it combines `register` to capture the API response, `until` to check that `result.status` equals 200 (the HTTP success code), `retries: 5` to attempt the task up to five times, and `delay: 30` to wait 30 seconds between retries. This ensures the task only fails after all five retries are exhausted, which is the exact behavior needed to handle transient API rate limiting.

Answer

`register: result`, `until: status == 200`, `retries: 5`, `delay: 30`

Answer

`until: result.status == 200`, `retries: 5`, `delay: 30`

Answer

`register: result`, `retries: 5`, `delay: 30`

Question 14

There are 5 hosts in the webservers group. All updates succeed on the first batch of 2 hosts. On the second batch, one host fails. What is the result?

Accepted Answer

The play aborts due to max_fail_percentage being exceeded.. The play defines a rolling update with a batch size of 2 and a max_fail_percentage of 20%. With 5 hosts total, 20% of 5 is 1, so only 1 failure is allowed. When the second batch has 1 failure, the cumulative failure count reaches 1, which equals the threshold, causing the play to abort. This is why option D is correct.

Answer

The play retries the failed host automatically.

Answer

The play marks the host as failed and continues with the next batch.

Answer

The play continues with the remaining 1 host in the third batch.

Answer

The play aborts immediately after the failure.

Question 15

Which TWO statements about Ansible roles are correct? (Select exactly 2)

Accepted Answer

Roles can have dependencies on other roles defined in `meta/main.yml`.. Option B is correct because Ansible roles can declare dependencies on other roles in their `meta/main.yml` file using the `dependencies` keyword. This ensures that dependent roles are executed before the dependent role, enabling modular and reusable automation workflows.

Answer

A role can directly include tasks from another role using the `include_tasks` module.

Answer

Variables defined in `defaults/main.yml` override those in `vars/main.yml`.

Answer

Roles cannot include playbooks.