EX294 Practice Test 2 — 10 Questions

Question 1

A playbook uses a loop to create multiple users. The administrator notices that if one user creation fails, the entire playbook stops. Which directive should be used to continue executing remaining iterations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ignore_errors. `ignore_errors` is a directive that, when set to `yes` on a task, allows Ansible to continue executing subsequent iterations of a loop even if that specific task fails. This ensures that a failure in creating one user does not halt the entire playbook, as Ansible will record the failure but proceed with the remaining items in the loop.

Answer

max_fail_percentage

Answer

any_errors_fatal

Answer

failed_when

Question 2

Given the command and error above, what is the most likely cause of the failure?

Accepted Answer

The --vault-id syntax is incorrect; 'vault@prompt' should be a label and password source, not a vault file.. The `--vault-id` option expects a label and a password source (e.g., `vault@prompt` means the label is 'vault' and the password is prompted interactively). The error indicates that Ansible is interpreting the entire string as a vault file path, which fails because no file named 'vault@prompt' exists. Option C correctly identifies that the syntax is being misapplied.

Answer

The vault file 'vault@prompt' does not exist.

Answer

The vault password file must be encrypted with ansible-vault.

Answer

The --check flag is incompatible with vault encryption.

Question 3

A new technician runs a playbook that uses the yum module to install packages. The playbook fails with 'No package matching' for a custom package. The package is available on a third-party repository. Which step should the technician take?

Accepted Answer

Add the repository using the yum_repository module.. The yum module requires that the repository providing the package is already configured on the target system. Since the custom package is on a third-party repository, the technician must first add that repository using the yum_repository module. This module creates the necessary .repo file in /etc/yum.repos.d/, making the package available for installation via the yum module.

Answer

Use the rpm_key module to import the GPG key.

Answer

Use command: yum install directly.

Answer

Update the package cache using yum update.

Question 4

An organization uses automation controller and has multiple teams. They want to create an inventory that automatically includes all hosts from a cloud provider that belong to the 'production' tag, and this inventory should be accessible only to the SRE team. What is the correct way to achieve this?

Accepted Answer

Create a smart inventory with a filter for tag 'production' and assign the SRE team the 'read' role on that inventory.. A smart inventory in automation controller allows you to dynamically filter hosts from an existing source (like a cloud provider) based on criteria such as tags. By creating a smart inventory with a filter for the 'production' tag, you automatically include all matching hosts. Assigning the SRE team the 'read' role on that inventory restricts access to only that team, meeting both requirements without manual updates.

Answer

Create a static inventory file and restrict access via a custom script.

Answer

Use groups in the inventory and assign all production hosts to a group, then restrict access to that group.

Answer

Create a dynamic inventory plugin in each playbook and include a condition to check team membership.

Question 5

An administrator has a requirements.yml file specifying roles from multiple sources: a public Galaxy server, a private Git repository, and a local path. They want to install all roles into the roles directory of the current project. Which command will achieve this?

Accepted Answer

ansible-galaxy install -r requirements.yml --roles-path ./roles. `ansible-galaxy install -r requirements.yml --roles-path ./roles` reads the requirements file and specifies the target directory for role installation. Option A is incorrect because it uses `collection install`, which installs collections, not roles. Option C is incorrect because `-p .` installs roles into the current directory, not the `roles` subdirectory. Option D is incorrect because while it installs roles, the `--force` flag is unnecessary and may overwrite existing roles without need.

Answer

ansible-galaxy collection install -r requirements.yml

Answer

ansible-galaxy install -r requirements.yml -p .

Answer

ansible-galaxy role install --force -r requirements.yml

Question 6

An organization uses Ansible Automation Platform to perform rolling updates on a 5-node PostgreSQL replication cluster. The playbook uses `serial: 1` and includes tasks to promote a standby, demote the primary, update PostgreSQL packages, and then re-elect the original primary. The cluster health check task verifies that replication lag is under 10 seconds before proceeding to the next node. Recently, during an update of the primary node (node1), the health check after re-election fails because replication lag is 15 seconds due to a large write load. The playbook aborts, leaving the cluster in a degraded state with node1 updated but not serving as primary. The administrator needs to ensure that the update continues while still maintaining cluster integrity. Which action should the administrator take?

Accepted Answer

Wrap the update tasks in a block with a rescue handler that reverts the update on the failed host and then continues with the next host.. Using a rescue block allows reverting the update on node1 (e.g., demote it back to standby, re-promote the original standby) so the cluster returns to its original state, and then continue with the next node. This ensures no node remains in an inconsistent state and the update can proceed. Option B is wrong because `ignore_errors` would continue without reverting the failed node, leaving node1 in a half-updated state that could cause issues. Option C is wrong because removing the health check could allow a broken cluster state to go undetected, risking data integrity. Option D is wrong because `max_fail_percentage: 20` would allow only 1 failure out of 5, but if node1 fails, the count is 1 (20%), so the playbook would still abort; even if it continued, it would not revert the failed node, leading to inconsistencies.

Answer

Add `ignore_errors: yes` to the health check task so the playbook continues despite the failure.

Answer

Remove the health check task to allow the update to proceed without interruption.

Answer

Set `max_fail_percentage: 20` to allow up to one failure per update run.

Question 7

An administrator wants to use a custom inventory script to dynamically generate hosts in Ansible Tower. Which of the following is a valid approach to manage credentials for accessing the script's API?

Accepted Answer

Define environment variables in the job template that references the inventory script, and use a credential type that injects those variables.. Ansible Tower (now Red Hat Ansible Automation Platform) allows custom credential types to inject environment variables into job runs. When a custom inventory script requires API authentication, you can define a credential type with injector configuration that sets environment variables (e.g., API_TOKEN, API_USER), then attach that credential to the job template. This keeps secrets out of scripts and repositories, following security best practices.

Answer

Attach the credential directly to the inventory script in the Ansible Tower UI.

Answer

Store the API token in a file within the project repository and source it in the script.

Answer

Embed the API token within the inventory script's JSON output.

Question 8

An administrator wants to create a custom credential type to store a third-party API key. The API key must be passed to the playbook as an environment variable `MY_API_KEY`. What is the correct Injector configuration in the custom credential type definition?

Accepted Answer

env: {MY_API_KEY: "{{ api_key }}"}. The Injector configuration for a custom credential type in Ansible Automation Platform uses the `env` key to map credential inputs to environment variables. The syntax `env: {"MY_API_KEY": "{{ api_key }}"}` correctly references the input field `api_key` using Jinja2 templating and assigns it to the environment variable `MY_API_KEY`, which the playbook can then access via `ansible_env.MY_API_KEY`.

Answer

file: {MY_API_KEY: "{{ api_key }}"}

Answer

env: {"MY_API_KEY": api_key}

Answer

extra_vars: {MY_API_KEY: "{{ api_key }}"}

Question 9

Refer to the exhibit. The playbook uses serial: 1 (one host at a time). The update failed on web3.example.com. Based on the output, what is the most likely reason the play did not abort the rollout and how should the playbook be modified to stop on failure?

Accepted Answer

Add max_fail_percentage: 0 to the play to abort on any failure.. The play uses `serial: 1` to update one host at a time, but by default Ansible continues to the next host even if a task fails on the current host. Setting `max_fail_percentage: 0` at the play level tells Ansible to abort the entire play immediately if any host fails, which is the intended behavior for a rolling update where a single failure should stop the rollout.

Answer

Add retries: 3 to the 'Update Apache config' task.

Answer

Set ignore_errors: yes on the 'Update Apache config' task.

Answer

Increase the serial value to update multiple hosts at once.

Question 10

Which TWO statements about Ansible role defaults are true?

Accepted Answer

Defaults are loaded from the defaults/main.yml file.. Ansible role defaults are defined in the defaults/main.yml file within the role directory structure. These defaults provide the most basic variable values that can be easily overridden by any other variable source, ensuring flexibility in role usage.

Answer

Defaults are only loaded if no vars are defined.

Answer

Defaults have higher priority than variables defined in the playbook.

Answer

Defaults cannot be overridden.