EX294 Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. A playbook fails with the given error. What is the most likely cause?

Accepted Answer

The vault password file is missing or incorrect.. The error in the exhibit (typically 'Attempting to decrypt but no vault secrets found' or 'no vault password file') indicates Ansible cannot decrypt vault-encrypted content because the vault password file is missing, unreadable, or contains the wrong password. Ansible needs either --ask-vault-pass or --vault-password-file pointing to a valid file. If the file path is wrong or the password is incorrect, decryption fails before the play can run.

Answer

The playbook syntax is wrong.

Answer

The inventory file is encrypted.

Answer

The remote host is unreachable.

Question 2

A system administrator wants to build an Ansible execution environment using ansible-builder. Which file format is required to define the base image, dependencies, and additional Python packages for the build?

Accepted Answer

execution-environment.yml. `ansible-builder` requires an `execution-environment.yml` file to define the build context, including the base image (under `version: 1`), system-level dependencies (under `dependencies: system:`), and additional Python packages (under `dependencies: python:`). This file is the mandatory definition file for building an Ansible Execution Environment (EE) using `ansible-builder build`.

Answer

ansible-navigator.yml

Answer

Containerfile

Answer

requirements.yml

Question 3

A playbook needs to set a fact 'total_memory' by summing the 'memory_mb' values from a list of servers. Which filter should be used?

Accepted Answer

{{ servers | map(attribute='memory_mb') | sum }}. It uses the `map` filter with the `attribute` parameter to extract the `memory_mb` value from each dictionary in the list, then pipes the resulting list of integers into the `sum` filter to compute the total. This is the standard Ansible idiom for summing a specific attribute across a list of dictionaries.

Answer

Answer

Answer

Question 4

You need to run an Ansible playbook every hour to update a dynamic inventory file from a CMDB API. The playbook is stored in /opt/ansible/update_inventory.yml. You want to schedule the execution using a cron job on the control node. The control node runs Red Hat Enterprise Linux 9. The playbook uses Ansible Vault to decrypt API credentials, and the vault password is stored in /etc/ansible/.vault_pass. Which cron entry will execute the playbook hourly?

Accepted Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml. It specifies the correct cron schedule (0 * * * * for hourly), uses the correct command (ansible-playbook), and points to the correct vault password file (/etc/ansible/.vault_pass) as specified in the stem. Option A uses the wrong vault password file path (~/.vault_pass). Option B uses the wrong schedule (every minute). Option C uses the wrong command (ansible instead of ansible-playbook).

Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file ~/.vault_pass /opt/ansible/update_inventory.yml

Answer

* * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Answer

0 * * * * /usr/bin/ansible --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Question 5

Which key in the galaxy.yml file defines the collection's namespace?

Accepted Answer

namespace. The `namespace` key in the `galaxy.yml` file explicitly defines the collection's namespace, which is the first part of the fully qualified collection name (FQCN) and is used to organize collections under a specific publisher or organization on Ansible Galaxy. This is a required field in the `galaxy.yml` metadata file, as per the Ansible Collection structure.

Answer

collection

Answer

authors

Answer

name

Question 6

A team has developed several roles that share common variables. They want to organize these variables in a central file. Where should they place this file so it is automatically loaded by all roles?

Accepted Answer

In the playbook directory as group_vars/all.yml. Placing a file in the playbook directory as group_vars/all.yml makes it automatically loaded by all roles. Ansible automatically includes any YAML files in the group_vars directory that match group names, and the special group 'all' applies to every host. This centralizes shared variables without requiring explicit imports in each role.

Answer

In the inventory directory as host_vars/localhost.yml

Answer

In a common role's vars/main.yml

Answer

In a common role's defaults/main.yml

Question 7

An Ansible playbook sets 'serial: 20%' for rolling updates, but the inventory contains 5 hosts. How many hosts are updated simultaneously?

Accepted Answer

1. When 'serial: 20%' is set in an Ansible playbook, the percentage is calculated based on the total number of hosts in the inventory. With 5 hosts, 20% of 5 equals 1.0, which is rounded down to 1. Therefore, only 1 host is updated at a time during the rolling update.

Answer

2

Answer

3

Answer

0

Answer

5

Question 8

An Ansible playbook uses the 'block' and 'rescue' directives. Which two statements are true about this construct? (Choose two.)

Accepted Answer

A rescue section executes only if the block tasks fail.. Option B is correct because the 'rescue' section of a block is executed only when a task inside the corresponding 'block' fails, allowing error handling and recovery logic to run conditionally. Option D is correct because the 'always' section is guaranteed to run whether the block tasks succeed, fail, or are rescued, making it suitable for cleanup or finalization steps. Option A is incorrect because rescue tasks run only on hosts where the block failed, not on all hosts in the play. Option C is incorrect because blocks can be nested inside other blocks. Option E is incorrect because a block can contain only one 'rescue' section.

Answer

Rescue tasks are executed on all hosts in the play.

Answer

Blocks cannot be nested.

Answer

A block can have multiple rescue sections.

Question 9

A Red Hat Ansible Automation Platform installation uses a custom execution environment. The playbook runs fail with 'execution environment not found'. The execution environment is stored in a private registry requiring authentication. What must be configured?

Accepted Answer

Add the registry URL to the automation controller's container registry credentials. When an execution environment is stored in a private registry that requires authentication, the automation controller must have the registry's URL and credentials configured as a container registry credential. This credential is then used by the controller to authenticate and pull the execution environment image during job runs. Without this, the controller cannot access the private registry, resulting in the 'execution environment not found' error.

Answer

Set the execution_environment_image variable in the playbook

Answer

Configure the execution environment in the inventory

Answer

Add the registry to the project's source control

Question 10

Refer to the exhibit. What is the most likely cause of the job being in 'pending' state?

Accepted Answer

The job is queued because the capacity limit of the automation controller is reached.. In Ansible Automation Platform, when a job is in 'pending' state, it typically indicates that the automation controller has queued the job because the maximum number of concurrent jobs (capacity limit) has been reached. The controller uses a job fork limit and instance group capacity to determine how many jobs can run simultaneously; once that limit is hit, additional jobs are placed in a pending queue until capacity frees up.

Answer

The credential is invalid and the system is attempting to validate it.

Answer

The job template is configured with a survey that requires approval.

Answer

The project needs to be updated before the job can run.

Question 11

A company uses Ansible Automation Platform and wants to ensure that all playbook runs are logged for audit purposes. What is the simplest way to achieve centralized logging of job runs?

Accepted Answer

Configure the syslog server in the automation controller settings.. Automation Controller (formerly Ansible Tower) has a built-in setting under 'System → Logging' where you can configure a syslog server (e.g., using RFC 5424). Once configured, all job runs, playbook output, and audit events are automatically forwarded to that central syslog server without modifying any playbooks or adding custom callbacks. This is the simplest, most centralized, and most maintainable approach for audit logging.

Answer

Use the logging module in each playbook to write to a central syslog.

Answer

Add a playbook callback that sends output to a file on each node.

Answer

Enable verbose logging in the inventory file.

Question 12

Which directory is the default location for installed Ansible collections on a control node for a regular user?

Accepted Answer

~/.ansible/collections. For a regular (non-root) user on an Ansible control node, the default location for installed collections is `~/.ansible/collections`. This is defined by Ansible's default collection search path, which includes the user's home directory under `~/.ansible/collections` for user-level installations. When a user runs `ansible-galaxy collection install` without specifying a custom path, the collection is placed in this directory by default.

Answer

/usr/share/ansible/collections

Answer

/etc/ansible/collections

Answer

/opt/ansible/collections

Question 13

A user wants to use a collection from Automation Hub. Which command downloads and installs the collection to the default collections path?

Accepted Answer

ansible-galaxy collection install. The correct command to download and install a collection from Automation Hub to the default collections path is `ansible-galaxy collection install`. This command uses the `ansible-galaxy` utility, which is the standard tool for managing Ansible roles and collections, and the `collection install` subcommand specifically handles collection installation from configured sources like Automation Hub or Ansible Galaxy.

Answer

ansible-pull collection install

Answer

ansible-playbook collection install

Answer

ansible-collection install

Question 14

An Ansible playbook needs to ensure a service is enabled and running on boot. Which combination of parameters should be used with the 'systemd' module?

Accepted Answer

enabled: yes, state: started. The 'systemd' module in Ansible requires both 'enabled: yes' to set the service to start on boot and 'state: started' to ensure the service is currently running. This combination directly fulfills the requirement of ensuring a service is enabled and running on boot.

Answer

enabled: yes, state: reloaded

Answer

enabled: yes, daemon_reload: yes

Answer

enabled: yes, state: restarted

Question 15

A team develops an Ansible collection and wants to distribute it internally. They have a private Automation Hub. Which approach best ensures that collection dependencies from external sources are also available?

Accepted Answer

Define a requirements.yml in the execution environment that references both the private hub and external sources. Defining a `requirements.yml` in the execution environment allows you to specify collections from both the private Automation Hub and external sources (e.g., Ansible Galaxy). When building the execution environment, `ansible-builder` processes this file and resolves dependencies from the listed sources, ensuring all required collections are bundled into the container image. This approach automates dependency management and avoids manual installation or repository bloat.

Answer

Manually install each dependency on the control node

Answer

Include all dependencies directly in the collection's repository

Answer

Use ansible-galaxy collection download and then upload to private hub