EX294 Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. The administrator wants to run a playbook that installs a package on all webservers. Which command will use the existing configuration and inventory correctly?

Accepted Answer

ansible-playbook site.yml. The command 'ansible-playbook site.yml' uses the default Ansible configuration file (ansible.cfg) and the default inventory location defined there. If the administrator has already configured the inventory and other settings in ansible.cfg, this command will correctly target the webservers group as defined in the playbook. No extra flags are needed because the existing configuration is assumed to be in place.

Answer

ansible-playbook -e 'ansible_python_interpreter=/usr/bin/python3' site.yml

Answer

ansible webservers -m package -a 'name=httpd state=present'

Answer

ansible-playbook -i inventory site.yml

Question 2

Refer to the exhibit. After the playbook run fails on the 'Verify config' task, what happens to the 'restart service' handler?

Accepted Answer

The handler is not executed because the playbook failed before the end of the play.. Handlers are notified but only run at the end of the play if notified. However, if a subsequent task fails, the playbook stops, and handlers are not executed unless the 'force_handlers' option is set.

Answer

The handler runs immediately after the failed task.

Answer

The handler runs on the next playbook run.

Answer

The handler is executed because it was notified before the failure.

Question 3

An automation engineer wants to run a playbook only on hosts that belong to both the 'webservers' group and the 'production' group. Which inventory grouping method achieves this?

Accepted Answer

webservers:&production. In Ansible, the '&' operator is used to intersect groups. 'webservers:&production' targets hosts that are in both the 'webservers' and 'production' groups. Option B is wrong because 'webservers:production' uses ':' which is a union operator, meaning hosts in either group. Option C is wrong because 'webservers:!production' uses '!' to exclude hosts in production. Option D is wrong because 'webservers+,production' is not a valid inventory pattern; Ansible does not support '+' for group intersection.

Answer

webservers:production

Answer

webservers:!production

Answer

webservers+,production

Question 4

What is the most likely cause of the failure?

Accepted Answer

The nginx role's defaults or vars do not define 'nginx_version'.. The error indicates that Ansible cannot resolve the variable 'nginx_version' during the playbook run. Since the `--check` flag only simulates changes and does not affect variable resolution, the most likely cause is that the nginx role's `defaults/main.yml` or `vars/main.yml` does not define this variable, leaving it undefined and causing the failure.

Answer

The --check flag prevents role variable resolution.

Answer

The host web1 is not configured to use the nginx role.

Answer

The nginx role was not included in the playbook correctly.

Question 5

A systems administrator needs to run a playbook that installs packages on a group of managed nodes. The playbook should run only on nodes that are part of the 'web_servers' group in the inventory. Which approach is best practice?

Accepted Answer

Set 'hosts: web_servers' in the play.. Setting 'hosts: web_servers' in the play directly targets only the nodes in that inventory group, which is the simplest and most maintainable approach. This follows Ansible's best practice of declaring the target group explicitly in the playbook rather than relying on runtime flags or conditional logic, ensuring the playbook's intent is clear and portable.

Answer

Set 'hosts: all' and use '--limit web_servers' when running ansible-playbook.

Answer

Set 'hosts: localhost' and delegate tasks to web_servers.

Answer

Set 'hosts: all' and use a 'when' condition to check if the node is in the web_servers group.

Question 6

An organization uses separate network hops that require different SSH usernames for different inventory groups. Which Ansible configuration approach ensures each group uses the correct SSH user without duplicating playbooks?

Accepted Answer

Create a group_vars directory with a file named after the group containing ansible_user.. Group variables in Ansible are defined in group_vars/<group_name>.yml, and variables set there apply to all hosts in that group. Placing ansible_user in a group-specific file ensures each inventory group uses its correct SSH username without duplicating playbook logic. This is the idiomatic Ansible way to scope connection variables per group.

Answer

Specify the SSH user in the inventory file for each host.

Answer

Set the ansible_user variable in ansible.cfg.

Answer

Define ansible_user in the playbook using vars.

Question 7

Refer to the exhibit. The playbook copies all .conf files from the control node to host1. If the playbook runs again on the same host without any changes, which task status is expected?

Accepted Answer

All items will show 'ok' because files are identical.. Ansible's `copy` module is idempotent: when the source and destination files are identical (same content and checksum), the module reports `ok` rather than `changed`. On a second run with no source changes, all items in the loop will show `ok` because Ansible compares checksums and determines no copy is needed. This is the core idempotency guarantee of Ansible modules.

Answer

The task will fail because the destination directory already contains files.

Answer

The task will be skipped because the files already exist.

Answer

All items will show 'changed'.

Question 8

Which TWO statements about inventory groups in Ansible Automation Platform are correct? (Choose exactly two.)

Accepted Answer

A host can belong to multiple groups. Ansible's inventory system allows a host to belong to multiple groups simultaneously. This is a fundamental feature of Ansible's inventory model, enabling flexible host organization and variable inheritance from all parent groups.

Answer

Host variables are the only way to define variables for a host

Answer

Groups cannot be members of other groups

Answer

Dynamic inventory sources cannot produce groups

Question 9

A playbook uses the 'include_tasks' module to dynamically include tasks based on a variable. The playbook runs successfully on some hosts but fails on others with a 'template error' message. What is the most likely cause?

Accepted Answer

The variable used in the 'include_tasks' path has a Jinja2 template error.. The 'include_tasks' module dynamically resolves the path to a task file using a variable. If that variable contains a Jinja2 template error (e.g., undefined variable, syntax mistake, or filter misuse), Ansible will fail with a 'template error' message during the variable expansion phase, before the task file is even loaded. This explains why the error occurs only on hosts where the variable's value or context triggers the template failure.

Answer

The included task file does not exist on the control node.

Answer

The included task file has incorrect permissions.

Answer

The included tasks contain a syntax error.

Question 10

An administrator needs to update a web application that runs as a Kubernetes Deployment with 5 replicas. The application is stateless, but the update must not cause any downtime. Which TWO strategies ensure zero-downtime rolling updates?

Accepted Answer

Set strategy type to RollingUpdate with maxUnavailable=0 and maxSurge=1.. Option B is correct because a RollingUpdate strategy with maxUnavailable=0 and maxSurge=1 guarantees that no existing pod is terminated until a new pod is fully available, so the Deployment always keeps all 5 replicas serving traffic during the update. Option E is correct because a readiness probe tied to the application's health endpoint ensures Kubernetes only routes traffic to new pods once they are actually ready, preventing requests from hitting uninitialized instances during the rollout. Together, maxUnavailable=0/maxSurge=1 plus a readiness probe are the standard mechanism for zero-downtime updates of a stateless Deployment. Option A is wrong because omitting a liveness probe does not prevent downtime and removes Kubernetes' ability to restart unhealthy containers. Option C is wrong because maxUnavailable=1 allows a pod to be taken out of service before its replacement is ready, reducing capacity and risking dropped requests. Option D is wrong because the Recreate strategy terminates all existing pods before creating new ones, causing guaranteed downtime.

Answer

Omit the liveness probe from the pod spec.

Answer

Set maxUnavailable=1 and maxSurge=0.

Answer

Use the Recreate strategy.

Question 11

Refer to the exhibit. The playbook fails with an error about the package list. What is the issue?

Accepted Answer

The variable 'packages' is being converted to a string by the Jinja2 template, resulting in a list literal string.. The yum module expects a list of strings or a comma-separated string. The variable 'packages' is a list, but when used with 'name: "{{ packages }}"', Jinja2 converts it to a string representation like "['httpd', 'mariadb-server', 'php']". The yum module does not accept that format; it needs a proper list or comma-separated string.

Answer

The variable 'packages' is not accessible because it is defined in a vars_file.

Answer

The 'yum' module requires the 'name' parameter to be a comma-separated string, not a list.

Answer

The 'yum' module should use 'pkg' instead of 'name'.

Question 12

A team uses Ansible Automation Controller with multiple organizations. Each organization has its own set of machines that require different SSH keys. The administrator wants to ensure that users from one organization cannot use credentials from another organization. What is the best way to achieve this isolation?

Accepted Answer

Create credentials within each organization and assign organization-level access. In Ansible Automation Controller, credentials are scoped to organizations. By creating credentials within each organization and assigning organization-level access, the administrator ensures that credentials are only visible and usable by members of that organization. This leverages the built-in role-based access control (RBAC) that isolates resources by organization, preventing cross-organization credential access.

Answer

Store credentials in separate projects and restrict project access

Answer

Set 'Use' permission on credentials only for specific users

Answer

Place users in different teams and restrict credential access by team

Question 13

A junior administrator needs to rotate the password for a database user stored in an Ansible Vault-encrypted file (secrets.yml). The current password is unknown to the admin, but they have the vault password file (vault-pass.txt). The admin wants to edit the file securely without exposing the decrypted content in the terminal history or logs. Which command should they run?

Accepted Answer

ansible-vault edit --vault-password-file vault-pass.txt secrets.yml. `ansible-vault edit` decrypts the file to a temporary file, opens it in the default editor (e.g., vi), and upon saving, re-encrypts it transparently. This prevents the decrypted content from ever being written to the terminal history or logs, as the editing happens in a secure temporary location that is cleaned up after the editor closes.

Answer

ansible-vault decrypt --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault rekey --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault view --vault-password-file vault-pass.txt secrets.yml

Question 14

An Ansible role has a complex dependency tree. The administrator wants to ensure that dependencies are installed before the main role tasks. Which file should be used to define dependencies?

Accepted Answer

meta/main.yml. In Ansible, role dependencies are defined in the `meta/main.yml` file using the `dependencies` key. This ensures that any listed roles are executed before the main role's tasks, providing a controlled execution order. The `meta/main.yml` file is specifically designed for metadata such as dependencies, author information, and supported platforms.

Answer

defaults/main.yml

Answer

tasks/main.yml

Answer

vars/main.yml

Question 15

A user wants to build an execution environment from a definition file. Which command is used?

Accepted Answer

ansible-builder build -f execution-environment.yml. The `ansible-builder build` command is the correct tool for building an Ansible execution environment from a a definition file. The `-f` flag specifies the path to the `execution-environment.yml` file, which defines the base image, required collections, and system dependencies for the containerized environment.

Answer

ansible-playbook build -i ee.yml

Answer

ansible-execution-environment build -f ee.yml

Answer

ansible-galaxy build execution-environment.yml