EX294 Practice Exam 3 — 20 Questions

Question 1

An Ansible playbook retrieves a JSON response from an API and stores it in the variable `api_response`. The JSON structure is a list of objects, each with keys `name`, `status`, and `id`. The team needs to create a list of names for objects where status is 'active'. Which filter should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{{ api_response | selectattr('status', 'equalto', 'active') | map(attribute='name') | list }}. It uses `selectattr` to filter the list of objects to only those where `status` equals 'active', then `map` to extract the `name` attribute from each filtered object, and finally `list` to convert the result into a list. This is the standard Ansible approach for filtering a list of dictionaries and extracting specific keys.

Answer

Answer

Answer

Question 2

An Ansible Tower/AWX administrator wants to prevent users from viewing credential passwords in plain text. Which credential type should be used for SSH passwords?

Accepted Answer

Machine credential. Machine credentials in Ansible Tower/AWX are the correct choice for SSH passwords because they are specifically designed to store SSH authentication parameters, including passwords, private keys, and key passphrases. When a machine credential is configured with an SSH password, Tower/AWX encrypts the password at rest and never exposes it in plain text to users through the web interface or API, ensuring that credential secrets remain hidden.

Answer

SSH credential

Answer

Password credential

Answer

Login credential

Question 3

An Ansible playbook sets 'serial: 20%' for rolling updates, but the inventory contains 5 hosts. How many hosts are updated simultaneously?

Accepted Answer

1. When 'serial: 20%' is set in an Ansible playbook, the percentage is calculated based on the total number of hosts in the inventory. With 5 hosts, 20% of 5 equals 1.0, which is rounded down to 1. Therefore, only 1 host is updated at a time during the rolling update.

Answer

2

Answer

3

Answer

0

Answer

5

Question 4

Drag and drop the steps to configure a container using Podman with a custom Dockerfile in the correct order.

Accepted Answer

Create a Dockerfile, then build the image using podman build, then list images using podman images, then run the container using podman run, then verify the container is running using podman ps.. Podman workflow: create Dockerfile, build image, list images, run container, verify.

Answer

Build the image using podman build, then create a Dockerfile, then run the container using podman run, then list images using podman images, then verify the container is running using podman ps.

Answer

Create a Dockerfile, then list images using podman images, then build the image using podman build, then run the container using podman run, then verify the container is running using podman ps.

Answer

Run the container using podman run, then create a Dockerfile, then build the image using podman build, then list images using podman images, then verify the container is running using podman ps.

Question 5

An admin imports this inventory into AAP and assigns a machine credential that uses SSH key authentication. The job fails with 'Authentication failed'. What is the most likely cause?

Accepted Answer

The machine credential does not contain an SSH private key.. In Red Hat Ansible Automation Platform (AAP), when a machine credential is assigned to a host, that credential's SSH key is used for authentication. If the credential does not contain an SSH private key, authentication will fail. Credentials take precedence over inventory variables such as ansible_ssh_private_key_file, so a conflict is not the likely cause. Therefore, the most likely cause is that the machine credential is missing its SSH private key.

Answer

The private key file path in the inventory does not exist on the controller.

Answer

The credential's SSH key is not being used because the inventory variable ansible_ssh_private_key_file conflicts.

Answer

The 'ansible_become' variable is missing from the inventory.

Question 6

A playbook uses roles with default variables. The administrator needs to override a default variable for a specific role only when that role is used. Which method should be used?

Accepted Answer

Pass the variable as a parameter to the role in the playbook.. When you need to override a default variable for a specific role only when that role is used, the correct method is to pass the variable as a parameter to the role in the playbook using the `vars` keyword within the role declaration. This ensures the override applies exclusively to that role invocation, without affecting other roles or the global playbook scope.

Answer

Set the variable in the inventory host_vars.

Answer

Set the variable in the role's vars/main.yml.

Answer

Set the variable in the playbook's vars section.

Question 7

You have two dictionaries: `dict1: {a: 1, b: 2}` and `dict2: {b: 3, c: 4}`. You want a new dict that combines both, with `dict2` values taking precedence for overlapping keys. Which filter chain achieves this?

Accepted Answer

`dict2 | combine(dict1, recursive=True)`. With recursive=True, the combine filter performs a deep merge where the left-hand operand (dict2) retains its values for overlapping keys when combined with dict1. This satisfies the requirement that dict2 values take precedence for the overlapping key 'b', resulting in {a: 1, b: 3, c: 4}.

Answer

`dict2 | combine(dict1)`

Answer

`[dict1, dict2] | combine`

Answer

`dict1 | combine(dict2)`

Question 8

Refer to the exhibit. What is the purpose of the 'failed_when' condition?

Accepted Answer

It fails the task only if the return code is non-zero and the error does not indicate 'not installed'.. The 'failed_when' condition in Ansible allows you to define custom failure criteria for a task. In the exhibit, the condition 'failed_when: result.rc != 0 and "not installed" not in result.stderr' means the task will only be marked as failed if the return code is non-zero AND the error message does not contain the string 'not installed'. This is useful when a command returns a non-zero exit code for expected reasons (e.g., package not found), and you want to treat that as a non-failure.

Answer

It ensures the task never fails regardless of return code.

Answer

It fails the task only if the package is installed.

Answer

It fails the task if the package is not installed.

Question 9

Refer to the exhibit. An administrator runs an Ansible playbook and gets an unreachable error. The administrator has set ansible.cfg as shown. Which configuration change would most likely resolve the issue?

Accepted Answer

Set 'ask_pass = true' in ansible.cfg.

Answer

Set 'become_ask_pass = false' in ansible.cfg.

Answer

Set 'host_key_checking = False' in ansible.cfg.

Answer

Add 'remote_user: root' to the playbook.

Question 10

Refer to the exhibit. A playbook fails with the error 'file not found: /var/www/app-v2.1.0.tar.gz' on the control node. What is the most likely cause?

Accepted Answer

The archive file does not exist on the control node. The copy task uses a relative path to the source file on the control node, which is not found.

Answer

The become: yes is missing from the copy task

Answer

The remote_src parameter is not set in the copy task

Answer

The unarchive task should use remote_src: no

Question 11

Refer to the exhibit. A role 'timezone' sets the timezone twice to different values. The role also depends on 'ntp'. After running a playbook that applies this role to server1, what is the timezone on server1?

Accepted Answer

America/New_York

Answer

The timezone is not set because of the dependency on ntp.

Answer

UTC

Answer

An error occurs because two tasks set the timezone.

Question 12

An admin attempts to build an execution environment using the exhibited files. The build fails with an error about incompatible Python dependency. What is the most likely cause?

Accepted Answer

The Python requirements.txt tries to install a version of Ansible that conflicts with the version in the base image.. The build fails because the Python `requirements.txt` file attempts to install a version of Ansible that conflicts with the version already present in the base image `ee-minimal-rhel8`. Execution environments are designed to include a specific Ansible version in the base image; adding a different version via pip creates a dependency conflict that breaks the build.

Answer

The execution-environment.yml file uses incorrect syntax for the 'dependencies' section.

Answer

The collections in requirements.yml are not fully qualified.

Answer

The base image 'ee-minimal-rhel8' is not a valid execution environment base image.

Question 13

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. `ansible-vault` encrypts variable files at rest using AES-256, allowing sensitive data like passwords or API keys to be stored securely in version control. When a playbook runs, the vault password must be provided (e.g., via `--ask-vault-pass` or a vault password file), and Ansible decrypts the file in memory only, never writing plaintext to disk. This ensures that sensitive values are not exposed in the playbook source code or logs.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 14

Refer to the exhibit. A playbook includes this vars file and runs `systemctl restart httpd`. The playbook fails because it cannot decrypt the vault. Which of the following is the most likely cause?

Accepted Answer

The vault password is not provided.. The error 'cannot decrypt the vault' indicates that Ansible is unable to decrypt the vault-encrypted variable file. This occurs when the vault password is not provided via `--ask-vault-pass`, `--vault-password-file`, or the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable. Without the correct password, Ansible cannot decrypt the vault, causing the playbook to fail.

Answer

The vault ID is missing.

Answer

The variable db_password is not used in the playbook.

Answer

The vault file is corrupted.

Question 15

A playbook uses `{{ my_var | default('fallback') }}`. What is the effect?

Accepted Answer

If `my_var` is undefined, the expression evaluates to 'fallback'.. The `default` filter in Ansible (also known as `d()`) returns the specified fallback value only when the variable is undefined. If `my_var` is defined but empty or None, the filter returns the variable's value (empty string or None), not the fallback. This behavior is specific to the `default` filter's default mode; to also catch empty or None values, you must use `default('fallback', true)`.

Answer

If `my_var` is defined but empty, the expression evaluates to 'fallback'.

Answer

If `my_var` is defined but equal to None, the expression evaluates to 'fallback'.

Answer

The filter raises an error because 'default' is not a valid filter.

Question 16

What is the purpose of the 'meta: flush_handlers' task?

Accepted Answer

Force handlers to run immediately. The 'meta: flush_handlers' task in Ansible is used to force any pending handler notifications to run immediately at that point in the play, rather than waiting until the end of the play. This is correct because it ensures that handlers triggered by earlier tasks execute right away, which is essential when subsequent tasks depend on the state changes those handlers make (e.g., restarting a service before configuring it further).

Answer

Restart services immediately

Answer

Clear the handler queue

Answer

Wait for handlers to complete

Question 17

An Ansible playbook includes a role that defines default variables in 'defaults/main.yml' and role variables in 'vars/main.yml'. A playbook sets the same variable in the play's 'vars' section. Which variable value takes precedence?

Accepted Answer

Play vars. In Ansible, variable precedence is hierarchical, and play vars (set directly in the play's `vars` section) have a higher priority than role defaults and role vars. Specifically, play vars override role vars, which in turn override role defaults. Therefore, when the same variable is defined in all three locations, the play vars value takes precedence.

Answer

Role defaults

Answer

Inventory group vars

Answer

Role vars

Question 18

An administrator must parse an inventory file where hostnames are stored in YAML format under a list 'nodes'. The task needs to extract only hostnames that contain 'prod' in the name, then sort them in reverse order. Which combination of filters in a single Ansible expression achieves this?

Accepted Answer

nodes | select('match', '.*prod.*') | sort(reverse=True). The `select` filter with the `match` test returns only list items that match the regex `'.*prod.*'`, i.e., hostnames containing 'prod'. The `sort(reverse=True)` then sorts the resulting list in descending alphabetical order, fulfilling both requirements in a single Ansible expression.

Answer

nodes | regex_search('prod') | sort(True)

Answer

nodes | map('regex_search', 'prod') | sort(reverse=True)

Answer

nodes | reject('match', '.*prod.*') | sort(reverse=True)

Question 19

A team uses Ansible to update a web application across 10 servers with minimal downtime. Which playbook directive achieves one-at-a-time updates?

Accepted Answer

serial: 1. C is correct because the `serial: 1` directive in an Ansible playbook controls the number of hosts that are updated simultaneously. Setting `serial: 1` forces Ansible to execute the playbook on one host at a time, ensuring that the web application is updated sequentially across the 10 servers, which minimizes downtime by keeping the other 9 servers available during each individual update.

Answer

run_once: true

Answer

delegate_to: localhost

Answer

throttle: 1

Answer

forks: 10

Question 20

A workflow template in automation controller consists of three job templates that must run sequentially with different credentials. The first job template uses a machine credential to provision a VM, the second uses a network credential to configure the switch, and the third uses a cloud credential to deploy the application. To secure the credential usage, what should the administrator configure?

Accepted Answer

Set each job template to use the appropriate credential and ensure workflow node permissions are set to 'use credential'.. Each job template can have its own credential defined. The workflow template does not directly hold credentials; it uses the credentials assigned to each job template. Option A (single credential) is not appropriate. Option C (validation rules) does not exist. Option D (assign to workflow) is not possible.

Answer

Create a single credential that covers all three environments.

Answer

Define credential validation rules in the workflow node properties.

Answer

Assign all three credentials to the workflow template directly.