EX294 Practice Test 19 — 15 Questions

Question 1

An Ansible playbook uses the `ansible_user` variable at the host level, but the SSH connection still uses root. Which configuration setting could override the playbook's user setting?

Accepted Answer

The Machine credential assigned to the job template specifies a different username.. In Ansible Tower/AWX, Machine credentials assigned to a job template take precedence over playbook-level variables like `ansible_user`. When a credential specifies a different username, it overrides the host variable because the credential system injects authentication parameters at runtime, effectively replacing the playbook's user setting for SSH connections.

Answer

The organization default user is root.

Answer

The playbook uses the directive 'remote_user: root'.

Answer

The inventory host variable ansible_user is not set.

Question 2

A job template consistently fails with 'Authentication failed' for a managed host. The admin has verified that the username/password in the credential is correct and that the host is reachable. What is the most likely remaining cause?

Accepted Answer

The credential is not linked to the job template.. The most likely remaining cause is that the credential is not linked to the job template. Even if the credential contains correct authentication data, the job template will not use it unless the credential is explicitly associated. Without this link, Ansible Tower/AWX cannot authenticate to the managed host, resulting in an 'Authentication failed' error.

Answer

The SSH private key has not been added to the credential.

Answer

The username in the credential is misspelled.

Answer

The host is not reachable on the network.

Question 3

Which THREE components are typically included in an execution environment?

Accepted Answer

Base OS image. An execution environment is a container image that provides a consistent, self-contained runtime for Ansible automation. It must include a base OS image (e.g., Red Hat Universal Base Image) to host the environment, Ansible Core and collections for automation logic, and a Python interpreter with its dependencies to execute modules and manage system interactions. These three components ensure portability and reproducibility across different control nodes.

Answer

Ansible Navigator

Answer

Ansible Tower/AWX

Question 4

Drag and drop the steps to configure a network bond (bond0) using nmcli in the correct order.

Accepted Answer

1. Create bond connection; 2. Add slave interfaces; 3. Set bonding mode; 4. Activate bond; 5. Verify bond status. The correct order to configure a network bond using nmcli is: create the bond connection first, then add slave interfaces to it, set the bonding mode (e.g., active-backup), activate the bond, and finally verify the bond status. This sequence ensures that the bond interface exists before adding slaves and that the mode is set before activation so that the bond operates correctly from the start.

Answer

1. Create bond connection; 2. Add slave interfaces; 3. Activate bond; 4. Set bonding mode; 5. Verify bond status

Answer

1. Set bonding mode; 2. Create bond connection; 3. Add slave interfaces; 4. Activate bond; 5. Verify bond status

Answer

1. Add slave interfaces; 2. Create bond connection; 3. Activate bond; 4. Set bonding mode; 5. Verify bond status

Question 5

Which TWO actions are valid for managing inventory group membership in Ansible Tower?

Accepted Answer

Assigning a host to multiple groups.. Ansible Tower allows a host to be a member of multiple groups simultaneously, enabling flexible inventory organization and variable inheritance. Option E is correct because host variables override group variables when the same key is defined at both levels, following Ansible's variable precedence rules.

Answer

Using a range expression in the inventory host file.

Answer

Deleting a group deletes all hosts in it.

Answer

Creating a group as a child of itself.

Question 6

The job template running against host db1 uses a machine credential with an SSH key. The key is correctly configured in Automation Controller. However, the job fails with the error shown. What is the most likely cause?

Accepted Answer

The SSH public key corresponding to the private key is not installed on the target host. The error indicates that Automation Controller cannot authenticate to host db1 using the SSH key. Since the key is correctly configured in the controller, the most likely cause is that the corresponding public key is not present in the target host's ~/.ssh/authorized_keys file. SSH key-based authentication requires the private key on the client (controller) and the public key installed on the target host; without the public key, the server rejects the connection attempt.

Answer

The vault password is incorrect

Answer

The SSH port is blocked by a firewall

Answer

The host's SSH host key has changed and the known_hosts file is outdated

Question 7

Which file is required to define the content of an Ansible execution environment when using ansible-builder?

Accepted Answer

execution-environment.yml. The `execution-environment.yml` file is the required definition file for `ansible-builder` because it specifies the base image, custom dependencies (Python, system, or collections), and additional build instructions needed to construct a containerized Ansible execution environment. Without this file, `ansible-builder` has no manifest to process, as it is the sole input that defines the environment's content.

Answer

Dockerfile

Answer

requirements.yml

Answer

ansible.cfg

Question 8

You have a list `my_list` containing `[0, 1, 2, '', 'hello']`. You want to extract the first truthy element that exists. Which chain achieves this?

Accepted Answer

`my_list | select('truthy') | first | default('')`. `select('truthy')` filters the list to include only elements that evaluate to `true` in Ansible/Jinja2 (non-zero numbers, non-empty strings, etc.), and `first` returns the first such element. The `default('')` provides a fallback if no truthy element exists. This chain correctly extracts `1` from the list `[0, 1, 2, '', 'hello']`.

Answer

`my_list | list | first | default('')`

Answer

`my_list | select('string') | first | default('')`

Answer

`my_list | first | default('')`

Question 9

Refer to the exhibit. The playbook fails to install httpd on server1. Which is the most likely cause?

Accepted Answer

The target host is not registered with Red Hat Subscription Manager. The error indicates no package found, likely because the target host is not subscribed to the necessary repositories.

Answer

The ansible.cfg file has an incorrect module path

Answer

The target host does not have internet access

Answer

The yum module should use state: present instead of latest

Question 10

A company uses Ansible Tower and has defined a custom inventory script. The inventory returns JSON with nested groups. The playbook needs to list all hosts from a specific group 'webservers' that are not in the 'drain' subgroup. Which combination of filters correctly extracts these hosts?

Accepted Answer

{{ groups['webservers'] | difference(groups['drain']) }}. The `difference` filter in Ansible returns the elements of the first list that are not present in the second list. This directly matches the requirement: all hosts in the 'webservers' group that are not in the 'drain' subgroup.

Answer

{{ groups['webservers'] | symmetric_difference(groups['drain']) }}

Answer

Answer

Question 11

A systems administrator is deploying Ansible Automation Platform 2.4 using the provided setup script. The installation fails with the error shown in the exhibit. Based on the exhibit, what is the most likely cause of the failure?

Accepted Answer

The PostgreSQL service is not running on the database server.. The error exhibit indicates that the installer cannot connect to the PostgreSQL database. The most common cause of this failure is that the PostgreSQL service is not running on the database server, preventing the Ansible Automation Platform setup script from establishing a connection. Without the database service active, the installer cannot proceed with the deployment.

Answer

The installer requires a local PostgreSQL database; using a remote database is not supported.

Answer

The database password specified in setup.sh does not match the actual PostgreSQL password.

Answer

SELinux is blocking the ansible-navigator process from reaching the database.

Question 12

Which two statements about ansible-vault are true? (Select exactly 2.)

Accepted Answer

Vault can encrypt entire files or individual variables.. Ansible-vault can encrypt either entire files (e.g., vars files, role defaults) or individual variables within a YAML file using the `!vault` tag. This flexibility allows you to protect sensitive data at the granularity you choose, without requiring separate encrypted files for each secret.

Answer

Vault-encrypted files cannot be used with include_vars.

Answer

Vault uses AES-128 encryption by default.

Answer

Vault passwords can be stored directly in ansible.cfg.

Question 13

A DevOps team maintains an Ansible environment using execution environments. They have been using a local execution environment image named 'custom-ee:latest' built with ansible-builder. Recently, they updated the requirements.yml file to include a new collection from Automation Hub. They rebuilt the execution environment using ansible-builder and pushed it to their private registry as 'registry.internal/custom-ee:1.2'. However, when running ansible-navigator on a control node, it still uses the old local image and does not pull the updated one. The ansible-navigator configuration file (ansible-navigator.yml) specifies:

execution-environment:
  image: registry.internal/custom-ee:1.2
  enabled: true
  pull:
    policy: tag

The control node has no prior local image with that tag. What is the most likely reason the new image is not being used?

Accepted Answer

An environment variable such as ANSIBLE_NAVIGATOR_EXECUTION_ENVIRONMENT_IMAGE overrides the configuration file, pointing to the old image.. Environment variables take precedence over configuration file settings in ansible-navigator. If `ANSIBLE_NAVIGATOR_EXECUTION_ENVIRONMENT_IMAGE` is set to the old local image (e.g., `custom-ee:latest`), it overrides the `image` value in `ansible-navigator.yml`, causing the tool to ignore the updated registry image. This is a common misconfiguration when environment variables persist from previous sessions or CI/CD pipelines.

Answer

The control node does not have network access to the registry, so it cannot pull the image and falls back to the local 'latest' image.

Answer

The pull policy 'tag' only pulls if the local image tag differs from the registry tag, and since the local image is 'latest', it compares to '1.2' and pulls, but something else prevents it.

Answer

The image was rebuilt with a different tag than '1.2', so the registry does not have that tag.

Question 14

An administrator is configuring Ansible Tower for a multi-environment deployment. The team has separate Azure service principals for dev, test, and prod, and uses Ansible Vault to encrypt sensitive variables. Which TWO configuration practices ensure secure credential management and clear inventory separation?

Accepted Answer

Create a single inventory and assign all hosts to groups named dev, test, and prod, then apply credentials at the group level.. Grouping hosts by environment within a single inventory and assigning Azure Service Principal credentials at the group level allows clear separation of environments while keeping inventory management centralized. This approach leverages Tower's native group-level credential assignment to ensure each environment uses its own service principal without manual overrides. Option D is also correct because defining separate credential types with unique Vault IDs ensures each environment's encrypted variables are decrypted only with the corresponding vault password, preventing cross-environment access to secrets.

Answer

Use the same vault password and vault ID for all environments to simplify management.

Answer

Use a single credential of type 'Azure Service Principal' and manually override the secrets per job template.

Answer

Store the vault password in a file on the Tower server and reference it by path.

Question 15

A playbook fails with an error when evaluating `{{ mylist | select('match') }}`. What is the most likely cause?

Accepted Answer

The `match` test requires a regex pattern as an argument.. The `match` test in Ansible always requires a regex pattern as an argument (e.g., `match('^foo')`). Without providing a pattern, the test has nothing to match against, and the playbook fails. Option C correctly identifies this as the cause. The other options are incorrect: `select` can be used without `selectattr` (A), quotes are not the issue (B), and `filter` plugin is not a substitute (D).

Answer

The `select` filter must be used with `selectattr` for attributes.

Answer

The `select` filter requires the test name without quotes.

Answer

The `filter` plugin should be used instead of `select`.