EX294 Practice Exam 2 — 20 Questions

Question 1

Refer to the exhibit. An administrator wants to view the decrypted value of 'db_password' without modifying the file. Which command should be used?

Accepted Answer

ansible-vault view file.yml. The `ansible-vault view` command decrypts the file in memory and displays its contents to stdout without modifying the encrypted file on disk. This is the correct choice because the administrator only needs to see the decrypted value of 'db_password' and does not want to change the file.

Answer

ansible-vault rekey file.yml

Answer

ansible-vault decrypt file.yml

Answer

ansible-vault edit file.yml

Question 2

A developer wrote a custom filter plugin in a Python file `my_filters.py` and placed it in the directory `./filter_plugins/`. The playbook fails with 'ERROR! no filter named 'my_custom_filter''. The playbook is located in `/home/user/project/playbook.yml`. The `ansible.cfg` file in the same directory does not set `filter_plugins`. Which is the most likely cause?

Accepted Answer

The plugin file must be a Python module with a class named `FilterModule` and the filter function must be listed in the `filters` method. Ansible requires custom filter plugins to be Python modules that define a class named `FilterModule` with a `filters()` method returning a dictionary mapping filter names to their implementing functions. Without this structure, Ansible cannot discover or register the filter, causing the 'no filter named' error.

Answer

The filter file must be named `__init__.py`

Answer

The filter function must be imported in the playbook via `filter_plugins: my_filters`

Answer

The filter function name does not match the class name in the plugin

Question 3

Refer to the exhibit. An administrator runs an Ansible playbook and receives the error shown. The playbook uses a variable 'vault_httpd_port' that should be stored in an encrypted vault file. Which step should the administrator take first to resolve the issue?

Accepted Answer

Ensure the vault file is referenced in the playbook using include_vars or vars_files, and that the vault password is correct.. The error indicates Ansible cannot find the variable 'vault_httpd_port' because the encrypted vault file containing it is not being loaded into the playbook's variable scope. The administrator must first verify that the vault file is properly referenced via include_vars or vars_files in the playbook, and that the correct vault password is supplied (e.g., via --ask-vault-pass or a vault password file). Without loading the vault file, the variable remains undefined regardless of encryption password changes.

Answer

Re-encrypt the vault file with a different password.

Answer

Add 'vault_httpd_port' to the group_vars/all.yml file without encryption.

Answer

Use the --ask-vault-pass option again with a different password.

Question 4

Match each Ansible module to its primary function.

Accepted Answer

yum: Manages packages using the yum package manager. The yum module manages packages, service manages system services, and copy transfers files from local to remote. Common confusions include swapping definitions or using the wrong direction for file transfers.

Answer

yum: Manages services (start, stop, restart, enable)

Answer

service: Manages packages using the yum package manager

Answer

copy: Copies files from remote to local hosts

Question 5

An administrator needs to securely store a database password used across multiple roles in a shared repository. Which approach is recommended?

Accepted Answer

Use ansible-vault to encrypt the password string and store it in a file, then include_vars.. Ansible-vault encrypts sensitive data at rest using AES-256, and the encrypted file can be safely stored in a shared repository. The `include_vars` module then decrypts the file at runtime when the vault password is provided, allowing multiple roles to access the password without exposing it in plaintext.

Answer

Use a lookup plugin to fetch from a secrets manager.

Answer

Store the password in an environment variable on the controller.

Answer

Hardcode the password in the playbook and use .gitignore.

Question 6

An administrator needs to execute a role named `common` on all hosts in the play, but only for hosts that are members of the `webservers` group. Which playbook construct achieves this?

Accepted Answer

Apply the role under a play with hosts: webservers.. The most direct way to run a role only on a specific group is to target that group in the play's hosts directive. Roles run on all hosts in the play, so restricting the play's hosts restricts the role. Other options either do not filter hosts or misuse Ansible features.

Answer

Add a task with delegate_to: webservers before including the role.

Answer

Set a variable in group_vars/webservers.yml and use it in the role's tasks.

Answer

Use the roles keyword with a when condition on the group name.

Question 7

A company manages its infrastructure using Ansible Tower. There are two teams: Team Alpha manages web servers in the 'webservers' group, and Team Beta manages database servers in the 'dbservers' group. Both teams need to use the same SSH credential to connect to their respective servers. The credential is stored in Tower as 'shared_ssh_key'. Team Alpha reports that they can launch jobs against the 'webservers' group, but Team Beta gets an error when trying to launch jobs against the 'dbservers' group: 'You do not have permission to use this credential.' Both teams are members of the same organization. The inventory is a single inventory source with separate groups. The credential has been assigned to the organization. What is the most likely cause of Team Beta's issue, and what is the correct solution?

Accepted Answer

Grant Team Beta the 'Use' role on the credential 'shared_ssh_key'.. In Ansible Tower, credentials are assigned to an organization, but users or teams must be explicitly granted the 'Use' role on a credential to be able to use it in a job template. Team Alpha can use the credential because they likely have the 'Use' role, while Team Beta does not. Granting Team Beta the 'Use' role on 'shared_ssh_key' resolves the permission error.

Answer

Create a new credential with the same SSH key and assign it to Team Beta.

Answer

Assign the credential to the dbservers group in the inventory.

Answer

Move the credential from the organization to the project level.

Question 8

Consider the task: `- debug: msg={{ item | upper }}` with `loop: "{{ ['a','b'] }}"`. What will be the output?

Accepted Answer

Two debug messages: 'A' and 'B'. The `upper` filter in Ansible converts each string item in the loop to uppercase. The `loop` directive iterates over the list `['a','b']`, and for each iteration, the `{{ item | upper }}` expression applies the `upper` filter to the current item, resulting in `'A'` and `'B'`. The `debug` module then prints each transformed value as a separate message.

Answer

An error because upper expects a string, not a loop variable.

Answer

Two debug messages: 'a' and 'b'

Answer

One debug message with the list ['A','B']

Question 9

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 10

An administrator wants to reuse a set of tasks across multiple playbooks. Which Ansible approach is most appropriate?

Accepted Answer

Creating a role with tasks in tasks/main.yml.. Roles are the standard Ansible mechanism for packaging and reusing tasks, variables, handlers, and other automation content across multiple playbooks. By placing tasks in a role's `tasks/main.yml`, the administrator can reference that role in any playbook using the `roles:` directive, enabling clean, modular reuse without duplication.

Answer

Encrypting the tasks with Ansible Vault.

Answer

Using ansible-doc to document the tasks.

Answer

Writing a custom module in Python.

Question 11

A collection version is already published on Automation Hub. The developer needs to update the collection with a new feature. What must be done to the version number before publishing again?

Accepted Answer

Increment the patch or minor version number.. Automation Hub enforces immutable collection versions; once a version is published, it cannot be overwritten or deleted. To publish a new feature, you must increment the patch (e.g., 1.0.0 → 1.0.1) or minor (e.g., 1.0.0 → 1.1.0) version number in the galaxy.yml file, following semantic versioning (semver) as required by Ansible collections.

Answer

No change needed; Automation Hub overwrites.

Answer

Increment the major version number.

Answer

Change the version to a pre-release identifier.

Question 12

An organization uses a private automation hub to distribute collections. A developer has created a new collection and needs to ensure it is available in the hub for others. Which command should the developer use to upload the collection to the private automation hub?

Accepted Answer

ansible-galaxy collection publish. `ansible-galaxy collection publish` is the command specifically designed to upload a built collection artifact (a .tar.gz file) to a Galaxy server, including a private automation hub. This command sends the collection to the configured Galaxy server endpoint, making it available for others to install via `ansible-galaxy collection install`.

Answer

ansible-galaxy collection import

Answer

ansible-galaxy collection build

Answer

ansible-galaxy collection install

Question 13

What is the purpose of the 'vars' keyword under the httpd role inclusion?

Accepted Answer

Override default variables for that role. The 'vars' keyword under a role inclusion in Ansible allows you to override the default variables defined within that specific role. This is done at the point of inclusion, providing role-specific variable overrides without affecting other roles or the playbook's global variable scope.

Answer

Set variables for the common role

Answer

Define new variables for the playbook

Answer

Set variables for all roles in the play

Question 14

A developer wants to reuse a set of tasks that conditionally include other task files based on variables defined per host. Which method should be used to ensure the included tasks are evaluated per host at runtime?

Accepted Answer

include_tasks. Include_tasks, because it dynamically loads and evaluates task files at runtime, allowing conditional logic and per-host variables to be resolved when the tasks are executed. This is essential for reusing a set of tasks that conditionally include other task files based on variables defined per host, as include_tasks processes the included file fresh each time it is encountered, respecting any host-specific variable context.

Answer

include_role

Answer

import_role

Answer

import_tasks

Question 15

Refer to the exhibit. An administrator runs the playbook but the wait_for task fails. What is the most likely cause?

Accepted Answer

The ansible_facts variable may not be available because fact gathering is disabled.. The playbook uses `ansible_facts['ansible_tcpip_socket']['port']` to supply the port number to the `wait_for` module. If fact gathering is disabled (e.g., via `gather_facts: no` at the play level or `ANSIBLE_GATHERING=explicit`), the `ansible_facts` dictionary is empty, so the variable resolves to `None` or an undefined value, causing the task to fail. The error is not a syntax or type issue but a missing fact dependency.

Answer

The http_port variable is misspelled.

Answer

The wait_for module requires the 'port' parameter to be an integer.

Answer

The delegate_to should be set to the remote host.

Question 16

An administrator needs to provide a set of credentials to a job template that requires a machine credential for SSH and a source control credential for the project. What is the correct way to associate these credentials?

Accepted Answer

Assign both a machine credential and a source control credential to the job template. Ansible Tower/AWX allows multiple credentials of different types to be assigned to a single job template. A machine credential handles SSH authentication for target hosts, while a source control credential manages authentication for the project repository (e.g., Git). This separation follows Ansible's modular credential design, where each credential type serves a distinct purpose and can be independently managed.

Answer

Define the source control token in the playbook using the 'set_fact' module

Answer

Create a single credential that includes both SSH key and source control token

Answer

Store the source control token as an extra variable in the job template

Question 17

Which two actions are appropriate when configuring a custom execution environment for an automation controller job? (Choose two.)

Accepted Answer

Building the execution environment using ansible-builder. Option B is correct because ansible-builder is the supported tool for creating custom execution environments; it reads an execution-environment.yml definition file and produces a container image containing the required collections, Python packages, and system dependencies. Option E is correct because the execution environment image is defined by a Containerfile (or Dockerfile) that specifies the base image and installs the needed packages, which ansible-builder uses as its build input. Option A is incorrect because execution environments can be stored in private registries (e.g., automation hub, private container registries), not only public ones, and public-only storage is not a requirement. Option C is incorrect because execution_environment_image is configured on the job template or organization in the automation controller, not in the project's SCM repository. Option D is incorrect because using the default execution environment does not constitute configuring a custom execution environment, which is what the scenario requires.

Answer

Storing the execution environment in a public registry only

Answer

Setting the execution_environment_image in the project's SCM

Answer

Using the default execution environment provided by controller

Question 18

Drag and drop the steps to configure a basic NFS server to export a directory in the correct order.

Accepted Answer

Install NFS packages, create directory, configure /etc/exports, start NFS service, verify export. To configure a basic NFS server to export a directory, the correct sequence is: install the NFS packages (e.g., nfs-utils), create the directory to be shared, edit /etc/exports to define the export, start and enable the NFS server service, and finally verify the export using 'showmount -e localhost'. This workflow ensures that all prerequisites are met before each step, avoiding errors such as missing directories or unapplied configuration.

Answer

Install NFS packages, create directory, start NFS service, configure /etc/exports, verify export

Answer

Create directory, install NFS packages, configure /etc/exports, start NFS service, verify export

Answer

Install NFS packages, configure /etc/exports, create directory, start NFS service, verify export

Question 19

A playbook has a dictionary `config` that maps service names to ports. The team wants to iterate over both keys and values in a task. Which filter should be used to convert the dictionary into a list of key-value pairs?

Accepted Answer

dict2items. The `dict2items` filter is the correct choice because it converts a dictionary into a list of key-value pairs, each represented as a dictionary with `key` and `value` keys. This is the standard Ansible filter for iterating over both keys and values in a `loop` within a task, enabling access to `item.key` and `item.value`.

Answer

items2dict

Answer

flatten

Answer

json_query

Question 20

Match each storage concept to its description.

Accepted Answer

LVM: Allows flexible disk management with volume groups and logical volumes. The correct matches are: LVM for flexible disk management with VGs and LVs, RAID for combining disks for redundancy/performance, Stratis for pool-based snapshots and thin provisioning, and VDO for block-level deduplication/compression. Common confusions include swapping LVM with VDO and RAID with Stratis.

Answer

LVM: Deduplicates and compresses data at the block level

Answer

RAID: Provides thin provisioning and snapshots using a pool-based model