EX294 Practice Exam 3 — 20 Questions

Question 1

An Ansible rolling update playbook has 'serial: 1' and 'max_fail_percentage: 0'. During the update of a 5-host group, the first host fails. What is the outcome?

Accepted Answer

The play aborts immediately. With 'serial: 1', Ansible updates one host at a time. 'max_fail_percentage: 0' means that if any host fails (0% failure tolerance), the entire playbook run is aborted immediately. When the first host fails, Ansible stops further execution because the failure percentage exceeds the threshold, and no retries or continuation occur.

Answer

The play pauses for manual intervention

Answer

The play retries the failed host

Answer

The play continues with the remaining 4 hosts

Answer

The play marks the host as unreachable and continues

Question 2

A team uses Ansible to update a web application across 10 servers with minimal downtime. Which playbook directive achieves one-at-a-time updates?

Accepted Answer

serial: 1. C is correct because the `serial: 1` directive in an Ansible playbook controls the number of hosts that are updated simultaneously. Setting `serial: 1` forces Ansible to execute the playbook on one host at a time, ensuring that the web application is updated sequentially across the 10 servers, which minimizes downtime by keeping the other 9 servers available during each individual update.

Answer

run_once: true

Answer

delegate_to: localhost

Answer

throttle: 1

Answer

forks: 10

Question 3

An organization wants to deploy Ansible Automation Platform 2.x in a highly available configuration. Which component must be deployed in an active-active cluster to ensure controller failover?

Accepted Answer

Automation controller. The automation controller is the component that provides the web UI, REST API, and job execution management in Ansible Automation Platform 2.x. For high availability, multiple controller nodes must be deployed in an active-active cluster behind a load balancer, ensuring that if one controller fails, another can immediately take over without service interruption.

Answer

PostgreSQL database

Answer

Private Automation Hub

Answer

Automation mesh

Question 4

Which TWO statements are true regarding the deployment of Ansible Automation Platform in a highly available configuration?

Accepted Answer

The automation controller requires a PostgreSQL database that must be configured with replication for high availability.. Option C is correct because in a highly available Ansible Automation Platform deployment, the automation controller (the control plane) relies on an external PostgreSQL database, and HA is achieved by configuring that PostgreSQL instance with replication (e.g., streaming replication or a supported HA topology) so the controller can fail over without losing job data. Option E is correct because the automation mesh (based on receptor) is the component that provides resilient, fault-tolerant execution by routing jobs across hop nodes and execution nodes, allowing execution to continue even if individual nodes become unavailable. Option A is incorrect because automation hub's PostgreSQL database is not strictly required to be external for HA in the way described; hub can be deployed with its own supported database configuration, and the statement overstates the requirement. Option B is incorrect because execution nodes do not need direct network access to the automation controller's database; they communicate with the controller through the mesh/receptor network, not by connecting to PostgreSQL directly. Option D is incorrect because SQLite is not supported for production automation controller deployments; PostgreSQL is required.

Answer

The automation hub requires an external PostgreSQL database to store collections and execution environments.

Answer

Execution nodes must have direct network access to the automation controller database.

Answer

The automation controller can use an embedded SQLite database for production deployments.

Question 5

An Ansible administrator wants to use an encrypted vault file to store sensitive variables. Which command creates a new vault file and prompts for a password?

Accepted Answer

ansible-vault create secrets.yml. `ansible-vault create secrets.yml` creates a new encrypted vault file and immediately prompts the user to set a password, which is then used to encrypt the file. This command is specifically designed for initial creation of vault files, unlike `edit` which requires an existing file, `view` which only displays content, or `encrypt` which encrypts an existing plaintext file.

Answer

ansible-vault edit secrets.yml

Answer

ansible-vault view secrets.yml

Answer

ansible-vault encrypt secrets.yml

Question 6

Which command publishes a collection to Automation Hub?

Accepted Answer

ansible-galaxy collection publish ./namespace-name-1.0.0.tar.gz --token MYTOKEN. `ansible-galaxy collection publish` is the specific command used to upload a collection tarball to Automation Hub (or any Galaxy server). The `--token` flag provides the required API authentication token for the publish operation. This command sends the tarball to the server's API endpoint, which validates and imports the collection.

Answer

ansible-galaxy collection import ./namespace-name-1.0.0.tar.gz

Answer

ansible-galaxy collection upload ./namespace-name-1.0.0.tar.gz

Answer

ansible-galaxy collection push ./namespace-name-1.0.0.tar.gz

Question 7

A playbook uses serial: 2 and sets any_errors_fatal: true. The first batch of 2 hosts both fail. What happens?

Accepted Answer

The playbook aborts and no further batches run.. When `any_errors_fatal: true` is set and a batch of hosts fails, Ansible immediately aborts the entire playbook run for all remaining hosts, regardless of the `serial` setting. Since the first batch of 2 hosts both fail, no further batches are executed. This behavior is designed to prevent cascading failures in critical deployments.

Answer

The playbook continues with the next batch.

Answer

The playbook marks the batch as unreachable and continues.

Answer

The playbook retries the failed hosts.

Question 8

A role contains a handler. The playbook includes the role and also defines a task that notifies the same handler. When the playbook runs, the handler executes only once. Which of the following best explains this behavior?

Accepted Answer

handlers are deduplicated by name; multiple notifications trigger the handler only once per play. Ansible handlers are deduplicated by name within a play. When a handler is notified multiple times—whether from a role or a playbook task—it runs only once at the end of the play, after all tasks have completed. This prevents redundant executions and is a core design feature of Ansible's handler system.

Answer

the handler was already triggered by the role and is skipped for the play task

Answer

the role's handler uses 'listen' which overrides notifications

Answer

the playbook's task notifies a different handler with the same name

Question 9

An admin is configuring a project in Automation Platform to pull playbooks from a Git repository. Which source control type should be selected?

Accepted Answer

SCM. (SCM) is correct because Ansible Automation Platform uses Source Control Management (SCM) to integrate with Git repositories. When configuring a project, selecting 'SCM' allows the platform to pull playbooks, roles, and inventories directly from a remote Git repository, enabling version control and automated sync.

Answer

Local

Answer

Manual

Answer

Red Hat Insights

Question 10

A team wants to use a certified collection from Red Hat Automation Hub but cannot access it directly due to firewall restrictions. What is the best practice?

Accepted Answer

Set up a private Automation Hub and sync the collection.. Setting up a private Automation Hub and syncing the certified collection is the best practice for environments with firewall restrictions. This approach ensures that the collection remains in a trusted, curated state, is automatically updated, and can be consumed by all team members via `ansible-galaxy` without manual intervention, maintaining compliance with Red Hat's support policies.

Answer

Download the collection manually and install from a tarball.

Answer

Copy the collection from another team's workspace.

Answer

Use ansible-galaxy collection install with --offline flag.

Question 11

Match each firewall zone to its default behavior.

Accepted Answer

public: Rejects incoming traffic except for explicitly allowed services.. Common firewalld zones include public (default deny), trusted (allow all), external (NAT with limited inbound), dmz (limited inbound for public servers), internal (trusted but filtered), and drop (silent discard). Common confusions involve swapping the behaviors of public and trusted, or misunderstanding dmz as fully blocking instead of selectively allowing.

Answer

internal: Allows all incoming traffic from any source.

Answer

dmz: Drops all incoming traffic.

Question 12

Which THREE of the following are valid ways to define host variables in an Ansible inventory? (Choose exactly three.)

Accepted Answer

Inline in the inventory file, e.g., 'myhost ansible_host=192.168.1.1 http_port=8080'.. Ansible allows inline host variable definitions directly in the inventory file using key=value pairs after the hostname. This is a standard syntax where variables like 'http_port=8080' are assigned to the host 'myhost' and become available as Ansible facts during playbook execution. The 'ansible_host' special variable is also defined this way to override the connection address.

Answer

In the 'extra_vars' field of the job template.

Answer

In a credential's 'Input Configuration' as a secret variable.

Question 13

Which TWO elements can be used to include external task files in a playbook?

Accepted Answer

import_tasks. Both A. import_tasks and B. include_tasks are the two Ansible directives designed to bring external task files into a playbook, which is exactly what the scenario asks for. import_tasks is processed statically at playbook parse time, so the referenced YAML file's tasks are inserted before execution begins, making it suitable for fixed, always-included task lists. include_tasks is processed dynamically at runtime, allowing the included file to be chosen conditionally or looped over, which is useful when the task file depends on variables or facts. The other options do not belong: include_vars loads variables from an external file rather than tasks, add_host dynamically adds a host to the in-memory inventory, and include_role imports a role (which may contain tasks) but is not the directive for including a standalone external task file.

Answer

include_vars

Answer

add_host

Answer

include_role

Question 14

Refer to the exhibit. A user runs a playbook that creates hosts and then attempts to use a constructed inventory plugin. However, the constructed inventory does not group hosts by OS distribution. What is the most likely cause?

Accepted Answer

The constructed inventory runs before add_host tasks, so the hosts are not yet created.. The constructed inventory plugin processes inventory sources and applies Jinja2 conditions to group hosts based on variables. However, when used in a playbook alongside the `add_host` module, the constructed inventory is evaluated at the start of the play, before any tasks (including `add_host`) run. Therefore, hosts added dynamically via `add_host` do not exist when the constructed plugin attempts to group them, causing the groups to be empty. Option C correctly identifies this ordering issue.

Answer

The constructed plugin cannot be used with the add_host module.

Answer

The 'strict: false' setting ignores missing variables, causing the group to be empty.

Answer

The variable ansible_distribution is not defined because gather_facts is set to no.

Question 15

An organization uses Automation Controller with multiple teams. They want to ensure that team members can only launch job templates that are explicitly assigned to their team. Which configuration approach should be used?

Accepted Answer

Create roles and assign them at the job template level using team roles. Automation Controller (formerly Ansible Tower) uses Role-Based Access Control (RBAC) where roles (e.g., Execute, Admin) can be assigned to teams at the job template level. This ensures that only members of a specific team can launch the job templates explicitly assigned to that team, without affecting other teams or requiring organization-wide permissions.

Answer

Assign each team to an organization and set organization-level permissions

Answer

Set 'allow simultaneous' to false on job templates

Answer

Use an Identity Provider (IdP) to restrict access

Question 16

Which TWO statements about Ansible content collections are correct?

Accepted Answer

Collections can be distributed via Automation Hub or Galaxy.. Option C is correct because Ansible content collections can be obtained from both public Ansible Galaxy and Red Hat Automation Hub (as well as private Automation Hub instances), which are the standard distribution sources configured via ansible.cfg or the ansible-galaxy CLI. Option E is correct because a collection's source tree requires a galaxy.yml metadata file at its root, which defines the namespace, name, version, authors, and dependencies used when building and publishing the collection artifact. Option A is wrong because collections can also be installed from Automation Hub, private automation hubs, Git repositories, tarballs, or local paths, not only Galaxy. Option B is wrong because a collection name uses the format namespace.collection (for example, ansible.builtin), so it must include a namespace rather than being a single word. Option D is wrong because collections can contain many content types beyond roles and playbooks, including modules, plugins, filters, tests, and documentation.

Answer

Collections can be installed only from Galaxy.

Answer

The collection name must be a single word without namespace.

Answer

A collection can contain only roles and playbooks.

Question 17

In an Ansible playbook, the 'strategy' parameter is set to 'free'. What behavior does this strategy produce?

Accepted Answer

Each host runs through the playbook independently of other hosts.. The 'free' strategy in Ansible allows each host to run through the playbook independently, without waiting for other hosts to finish the current task. This means a faster host can proceed to subsequent tasks while slower hosts are still working on earlier tasks, maximizing parallelism and reducing overall execution time.

Answer

Playbook runs tasks on hosts in batches of 1.

Answer

Strategy is deprecated and replaced by 'linear'.

Answer

All hosts run the same task at the same time, then move to the next task.

Question 18

Which TWO of the following are advantages of using 'ansible-pull' over 'ansible-playbook'?

Accepted Answer

It can be used in environments where a central control node is not desired.. Option A is correct because ansible-pull is designed for decentralized setups: each managed host runs the ansible-pull command itself, fetching and executing a playbook from a git repository, so no persistent central control node is required to push configurations. Option C is correct because ansible-pull's core behavior is exactly that nodes self-configure by cloning or updating a playbook from a git repository (via the -U/--url option) and then running it locally with ansible-playbook under the hood. Option B is not a real advantage: ansible-pull still relies on an inventory (typically localhost or a local inventory file) to determine targets, so it does not eliminate inventory usage. Option D is false because ansible-pull uses the same YAML playbook syntax as ansible-playbook; there is no separate, more efficient syntax. Option E is misleading: although execution happens locally, ansible-pull does not inherently reduce control-node load as a designed advantage, and the question asks for advantages over ansible-playbook, which is not established by this option.

Answer

It eliminates the need for an inventory file.

Answer

It supports a different syntax for playbooks that is more efficient.

Answer

It reduces load on the control node because it runs locally on each node.

Question 19

An admin needs to restrict which users can launch specific job templates. Which AAP feature should be used?

Accepted Answer

Role-based access control (RBAC) on job templates.. Role-based access control (RBAC) on job templates is the correct feature because it allows an administrator to assign specific permissions (e.g., execute, read, or admin) to users or teams for individual job templates in Ansible Automation Platform (AAP). This directly restricts which users can launch specific job templates without affecting other resources.

Answer

Execution environments with custom modules.

Answer

Machine credentials with different users.

Answer

Inventory groups with host restrictions.

Question 20

A playbook uses import_playbook to include other playbooks. The main playbook is run with --check mode. Which statement is true?

Accepted Answer

Imported playbooks are also run in check mode.. When a playbook uses `import_playbook`, the imported playbooks are statically included at parse time, meaning they become part of the main playbook's play structure. The `--check` mode flag applies to the entire playbook execution, so all imported playbooks also run in check mode. Option D is correct because Ansible propagates the check mode flag to all imported plays.

Answer

Only the main playbook runs in check mode; imported ones run normally.

Answer

All imported playbooks are skipped because import happens at parse time.

Answer

import_playbook does not support check mode.