EX294 Practice Exam 4 — 20 Questions

Question 1

Refer to the exhibit. A user includes this in the execution-environment.yml. The build process fails because the second collection cannot be resolved. What is the most likely reason?

Accepted Answer

The source URL is not a valid Galaxy server endpoint.. The execution-environment.yml references a Galaxy server endpoint that is not a valid Ansible Galaxy server. Ansible Builder resolves collections from Galaxy servers, and if the URL does not point to a recognized Galaxy API endpoint (e.g., https://galaxy.ansible.com), the build process cannot fetch the collection. The error indicates the second collection cannot be resolved, which directly points to an invalid or unreachable Galaxy server URL.

Answer

The format of the version constraint is invalid.

Answer

The source URL does not include the required endpoint like '/api/v3/'.

Answer

The second collection is not authorized for download.

Question 2

Based on the exhibit, what is the purpose of the `galaxy` dependency entry?

Accepted Answer

Define which Ansible collections to install in the execution environment.. In the context of Ansible execution environments (EEs), the `galaxy` key within the `dependencies` section of the `execution-environment.yml` file specifies a list of Ansible collections to be installed from Ansible Galaxy or an Automation Hub. This allows the EE to include the necessary content collections required for playbook execution, ensuring all roles and modules are available inside the container.

Answer

Set the base container image.

Answer

Specify Python packages to install via pip.

Answer

Configure environment variables for the container.

Question 3

A security team requires that all automation controller job logs be forwarded to an external SIEM system. Which integration should be used?

Accepted Answer

Automation controller's built-in logging aggregator. Automation controller (formerly Ansible Tower) includes a built-in logging aggregator that can forward job logs to external SIEM systems via supported protocols such as HTTPS, TCP, or UDP. This integration is configured directly in the controller's settings, requiring no additional scripts or system-level changes, making it the correct and supported method for centralized log forwarding.

Answer

Ansible Log Forwarder

Answer

Custom callback plugin

Answer

rsyslog configuration

Question 4

An Ansible automation team is designing a playbook to manage network devices. They need to ensure that the playbook can handle transient network failures by retrying failed tasks a specific number of times with a delay between retries. Which approach should they use?

Accepted Answer

Use the `until` loop with `retries` and `delay` parameters on the task.. The `until` loop with `retries` and `delay` parameters is the correct approach because it allows a task to be retried a specified number of times with a configurable pause between attempts, directly addressing transient network failures. This is a built-in Ansible feature for handling intermittent issues without additional error-handling constructs.

Answer

Set `max_fail_percentage` in the play to 0 and use `ignore_errors: yes` with a rescue block.

Answer

Use the `throttle` keyword to limit concurrent tasks and rely on idempotency.

Answer

Set `serial: 1` on the play to ensure only one host is processed at a time and rely on idempotency.

Question 5

The debug output shows 'changed' even when the firewall rule already existed. Which filter issue could cause this?

Accepted Answer

The task should use 'immediate: yes' to reload the firewall, otherwise the module always reports changed.. C is correct because the `firewalld` module in Ansible, by default, operates in 'offline' mode (immediate: no), meaning it only modifies the permanent configuration without applying changes to the running runtime firewall. Even if a rule already exists in the permanent configuration, the module will report 'changed' because it still attempts to add the rule to the runtime zone unless `immediate: yes` is explicitly set to reload the firewall and synchronize the runtime state. This behavior is specific to how `firewalld` separates permanent and runtime rule sets.

Answer

The 'changed' key is misspelled as 'change' in the filter.

Answer

The variable 'fw_result' is undefined because the task failed.

Answer

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Question 6

A team has developed several roles that share common variables. They want to organize these variables in a central file. Where should they place this file so it is automatically loaded by all roles?

Accepted Answer

In the playbook directory as group_vars/all.yml. Placing a file in the playbook directory as group_vars/all.yml makes it automatically loaded by all roles. Ansible automatically includes any YAML files in the group_vars directory that match group names, and the special group 'all' applies to every host. This centralizes shared variables without requiring explicit imports in each role.

Answer

In the inventory directory as host_vars/localhost.yml

Answer

In a common role's vars/main.yml

Answer

In a common role's defaults/main.yml

Question 7

A junior admin created a custom credential type for a third-party API. When running a job that uses this credential, the job fails with 'type object 'Credentials' has no attribute' error. What is the most likely issue?

Accepted Answer

The 'inputs' section in the credential type definition has a misconfigured field name. The error 'type object 'Credentials' has no attribute' typically occurs when the credential type definition's 'inputs' section references a field name that does not match the actual attribute expected by the credential plugin or injector. In Ansible Tower/AWX, the 'inputs' section defines the fields a user fills in (e.g., username, password), and if a field name is misspelled or mismatched with what the credential plugin expects, the plugin cannot find the attribute, causing this error. Option A is correct because a misconfigured field name in 'inputs' directly leads to this attribute lookup failure.

Answer

The 'injectors' section in the credential type definition is missing

Answer

The credential is not assigned to the job template

Answer

The job template is missing the required extra variables

Question 8

An organization uses a private Git repository to store Ansible content collections. They want to automate the building of execution environments that include these collections. Which approach is recommended?

Accepted Answer

Build the collection manually, publish it to a private Automation Hub, then reference it in the EE.. The recommended workflow for including private collections in an execution environment is to build the collection, publish it to a private Automation Hub, and then reference it in the `execution-environment.yml` file. This ensures the collection is available as a signed, versioned artifact that `ansible-builder` can pull during the build process, maintaining integrity and reproducibility without exposing Git credentials or requiring network access during build.

Answer

Store the collection tarball in a Git LFS and use an ADD command in the base image.

Answer

Add the Git repository as a source in the execution-environment.yml using the 'git' type.

Answer

Use ansible-builder to clone the repository during build with a pre-build script.

Question 9

A user wants to authenticate against Ansible Automation Controller using LDAP. They configure the LDAP settings in the controller UI. After saving, they test the connection and it succeeds. However, when an LDAP user tries to log in, they get an authentication failure. What is the most likely issue?

Accepted Answer

The user has not been mapped to an organization within the LDAP configuration.. In Ansible Automation Controller, LDAP users must be explicitly mapped to an organization within the LDAP configuration. Without this mapping, the user is authenticated by the LDAP server but the controller has no authorization context (e.g., organization membership) to allow login. Option B correctly identifies this missing organization mapping as the most likely cause.

Answer

The user is not a member of the required LDAP group that is mapped to a team.

Answer

The controller is case-sensitive and the user entered username in wrong case.

Answer

The LDAP server is configured to use TLS, but the controller uses SAML.

Question 10

An Ansible playbook needs to dynamically include a set of variables based on the environment (dev/staging/prod). The developer wants to use a variable from a lookup plugin that returns a YAML file path. Which lookup plugin is most appropriate for fetching a file’s contents?

Accepted Answer

file. The `file` lookup plugin is the most appropriate for fetching the contents of a file from the control node, as it reads the entire file and returns its content as a string. This is ideal for dynamically including variable files based on environment (e.g., `{{ lookup('file', 'vars/{{ env }}.yml') }}`), allowing the playbook to load environment-specific YAML data.

Answer

env

Answer

pipe

Answer

template

Question 11

Which TWO of the following are best practices for securing automation controller secrets and credentials?

Accepted Answer

Use Ansible Vault to encrypt sensitive data like passwords and API keys. Ansible Vault provides encryption for sensitive data such as passwords and API keys, ensuring they are not stored in plaintext. This is a core security practice for automation controller secrets, as it protects credentials at rest and during transport when used with playbooks.

Answer

Store secrets in plain text in inventory files for simplicity

Answer

Disable logging to prevent exposure of sensitive data in logs

Answer

Grant all users admin access to reduce permission complexity

Question 12

Refer to the exhibit. The playbook fails because the httpd package is not found. Which is the most likely cause?

Accepted Answer

The target host does not have the necessary repositories enabled.. The error indicates the package is not available. This is typically due to missing or incorrect repository configuration. The playbook itself and role syntax are valid.

Answer

The inventory does not define 'webservers' group.

Answer

The role path is incorrectly configured in ansible.cfg.

Answer

The 'yum' module should use 'name=httpd' instead of YAML syntax.

Question 13

An organization needs to implement security best practices for Ansible automation. Which three measures should be taken? (Choose three.)

Accepted Answer

Use ansible-vault to encrypt sensitive variables. `ansible-vault` is the built-in Ansible tool for encrypting sensitive data such as passwords, API keys, and secret variables. It uses AES-256 encryption to protect secrets at rest, ensuring they are not exposed in plain text within playbooks, inventory files, or version control systems. This is a fundamental security best practice for any Ansible automation environment.

Answer

Store all secrets in plain text in repository

Answer

Disable SSH host key checking globally

Question 14

Refer to the exhibit. The playbook fails with an error about the package list. What is the issue?

Accepted Answer

The variable 'packages' is being converted to a string by the Jinja2 template, resulting in a list literal string.. The yum module expects a list of strings or a comma-separated string. The variable 'packages' is a list, but when used with 'name: "{{ packages }}"', Jinja2 converts it to a string representation like "['httpd', 'mariadb-server', 'php']". The yum module does not accept that format; it needs a proper list or comma-separated string.

Answer

The variable 'packages' is not accessible because it is defined in a vars_file.

Answer

The 'yum' module requires the 'name' parameter to be a comma-separated string, not a list.

Answer

The 'yum' module should use 'pkg' instead of 'name'.

Question 15

An administrator is configuring a job template in automation controller that runs a playbook to deploy a web application. The playbook requires a database password that changes quarterly. To avoid updating the credential each quarter, what is the best approach to dynamically provide the password without exposing it in the playbook?

Accepted Answer

Define a survey prompt in the job template that asks for the password during launch.. A survey prompt in the job template allows the password to be entered at launch time, avoiding hardcoding or storing it in the playbook or project. This approach dynamically provides the password each quarter without requiring credential updates, as the survey can be configured to prompt for the password as a variable that the playbook uses. It aligns with automation controller's built-in survey feature for secure, runtime variable input.

Answer

Use a lookup plugin to fetch the password from an external secrets manager.

Answer

Store the password as a variable in the project repository and encrypt it with ansible-vault.

Answer

Create a custom credential type that prompts for the password each launch.

Question 16

Consider the task: `- debug: msg={{ item | upper }}` with `loop: "{{ ['a','b'] }}"`. What will be the output?

Accepted Answer

Two debug messages: 'A' and 'B'. The `upper` filter in Ansible converts each string item in the loop to uppercase. The `loop` directive iterates over the list `['a','b']`, and for each iteration, the `{{ item | upper }}` expression applies the `upper` filter to the current item, resulting in `'A'` and `'B'`. The `debug` module then prints each transformed value as a separate message.

Answer

An error because upper expects a string, not a loop variable.

Answer

Two debug messages: 'a' and 'b'

Answer

One debug message with the list ['A','B']

Question 17

Which command publishes a collection to Automation Hub?

Accepted Answer

ansible-galaxy collection publish ./namespace-name-1.0.0.tar.gz --token MYTOKEN. `ansible-galaxy collection publish` is the specific command used to upload a collection tarball to Automation Hub (or any Galaxy server). The `--token` flag provides the required API authentication token for the publish operation. This command sends the tarball to the server's API endpoint, which validates and imports the collection.

Answer

ansible-galaxy collection import ./namespace-name-1.0.0.tar.gz

Answer

ansible-galaxy collection upload ./namespace-name-1.0.0.tar.gz

Answer

ansible-galaxy collection push ./namespace-name-1.0.0.tar.gz

Question 18

Which THREE actions are required to successfully publish a collection to Automation Hub?

Accepted Answer

Build the collection with ansible-galaxy collection build.. `ansible-galaxy collection build` is the required command to package a collection into a distributable tarball (e.g., `namespace-collection-1.0.0.tar.gz`). This tarball is the artifact that is then uploaded to Automation Hub. Without building the collection, there is no file to publish.

Answer

Sign the collection with GPG.

Answer

Run ansible-galaxy collection test.

Question 19

Based on the exhibit, which collection provides modules for managing Red Hat Insights subscriptions?

Accepted Answer

`redhat.insights`. The `redhat.insights` collection is the official Ansible collection from Red Hat that provides modules specifically for managing Red Hat Insights subscriptions, including `insights_register` and `insights_unregister`. This collection is maintained by Red Hat and is the correct source for automating Insights registration and subscription management tasks.

Answer

`community.general`

Answer

`ansible.posix`

Answer

`insights`

Question 20

A large enterprise has deployed Ansible Automation Platform with multiple organizations. A team lead needs to allow a junior administrator to create and manage job templates within their own organization, but not modify organizations, users, or system settings. Which RBAC roles should be assigned?

Accepted Answer

Assign the `job_template_admin` role on the specific organization.. The `job_template_admin` role on a specific organization grants the ability to create, edit, and manage job templates within that organization without allowing modifications to organizations, users, or system settings. This is the correct RBAC role for the junior administrator's requirements.

Answer

Assign the `admin` role on the organization.

Answer

Assign the `execute` role on all job templates.

Answer

Assign the `auditor` role on the organization.