EX294 Practice Test 21 — 15 Questions

Question 1

Which TWO options are best practices for coordinating rolling updates with Ansible? (Choose exactly two.)

Accepted Answer

Use the serial keyword to update hosts in batches.. The `serial` keyword in Ansible controls how many hosts are updated at a time during a rolling update, allowing you to update hosts in batches to maintain service availability. This is a best practice for coordinating rolling updates as it prevents overwhelming the infrastructure and ensures that a subset of hosts remains operational while others are being updated.

Answer

Set ignore_errors: yes to ensure the playbook continues even if some hosts fail.

Answer

Use the default serial setting (all hosts) for simplicity.

Answer

Run all hosts in parallel to minimize total update time.

Question 2

Which TWO statements about Ansible collections are correct?

Accepted Answer

Collections provide a way to package and distribute Ansible content.. Ansible collections are a distribution format for Ansible content that allows packaging and distributing playbooks, roles, modules, and plugins. They enable users to bundle related automation content into a single, versioned package that can be shared via Ansible Galaxy or Automation Hub. This makes option B correct because collections are explicitly designed for packaging and distribution.

Answer

Collections cannot be versioned.

Answer

Collections replace the need for inventory files.

Answer

Collections can only contain modules and roles.

Question 3

An Ansible playbook that installs packages and configures services is not idempotent. Which two practices should be implemented to make it idempotent? (Choose two.)

Accepted Answer

Use the command module with the 'creates' parameter.. Using the command module with the 'creates' parameter makes the task idempotent by skipping execution if the specified file or directory already exists. This prevents the command from running repeatedly and causing unintended changes. Option C is correct because setting state=present for package installation ensures that the package manager only installs the package if it is not already installed, making the task idempotent.

Answer

Use notify handlers to restart services only on change.

Answer

Use check_mode: yes to preview changes.

Answer

Set always_run: yes on tasks.

Question 4

Refer to the exhibit. A user runs ansible-runner with --container-image localhost/ee-30:latest and receives the error shown. What is the most likely cause?

Accepted Answer

The container image has not been pulled or built locally.. The error indicates that the container image `localhost/ee-30:latest` is not available locally. The `--container-image` flag tells ansible-runner to use a specific execution environment image, but if that image has not been pulled from a registry or built locally, the container runtime (e.g., Podman or Docker) cannot find it. Option D is correct because the image must exist in the local container storage before ansible-runner can launch it.

Answer

The container image tag is incorrect.

Answer

The ansible-runner process does not have network access.

Answer

The execution environment is not listed in the project's execution-environment.yml.

Question 5

Which two statements about Ansible roles are correct? (Select exactly 2.)

Accepted Answer

Roles can include tasks, handlers, variables, and defaults.. Options C and E are correct. Roles can contain tasks, handlers, variables, and defaults (C). Roles can be installed from Ansible Galaxy (E). Option A is incorrect because the meta/main.yml file is optional, not mandatory. Option B is incorrect because roles are not a type of playbook; they are a way to organize playbook content. Option D is incorrect because roles can be used with include_role or import_role.

Answer

Roles must have a meta/main.yml file.

Answer

Roles are a type of playbook.

Answer

Roles cannot be used with include_role.

Question 6

An organization uses multiple Satellite servers for inventory. They want to combine data from all satellites into one unified inventory in Ansible Tower. Which approach is best?

Accepted Answer

Create one inventory with multiple inventory sources, each pointing to a different Satellite.. Ansible Tower allows you to create a single inventory with multiple inventory sources, each configured to sync from a different Satellite server. This approach consolidates all host data into one unified inventory without custom scripting or requiring a central aggregator, leveraging Tower's native multi-source inventory capabilities.

Answer

Use a custom script to fetch and merge data from all Satellites into a single inventory source.

Answer

Create a smart inventory that includes all satellites.

Answer

Use a single Satellite server that aggregates data from all other Satellites.

Question 7

A DevOps engineer is designing a dynamic inventory script for a cloud provider. The script must return host variables in a specific JSON format. According to Ansible best practices, which top-level keys should be present in the script output?

Accepted Answer

Group names as keys, each containing 'hosts' and 'vars'. Ansible dynamic inventory scripts must return JSON with group names as top-level keys, each containing 'hosts' (a list of hostnames) and optionally 'vars' (dictionary of group variables). This structure allows Ansible to map hosts to groups and apply group-level variables, which is essential for inventory organization and playbook targeting. Option A correctly describes this required format per Ansible best practices.

Answer

all, groups, hosts

Answer

List of host objects

Answer

inventory, hosts, vars

Question 8

A DevOps engineer is troubleshooting an Ansible Automation Platform deployment where ansible-navigator fails to run a playbook, showing the error 'Error: Unable to pull execution environment image'. The ansible-navigator configuration file is shown in the exhibit. Which change should the engineer make to resolve the issue?

Accepted Answer

Change 'pull policy' from 'missing' to 'always'. The error 'Unable to pull execution environment image' indicates that the image specified in the ansible-navigator configuration cannot be retrieved from the registry. Setting the 'pull policy' to 'always' forces ansible-navigator to attempt a fresh pull of the execution environment image every time, which can resolve transient network issues, authentication problems, or stale local image caches that cause the pull to fail when the policy is 'missing'.

Answer

Set 'mode' to 'interactive' instead of 'stdout'

Answer

Change the execution-environment image to 'registry.redhat.io/ansible-automation-platform-24/ee-minimal-rhel8:latest'

Answer

Set 'playbook-artifact enable' to 'true'

Question 9

Based on the exhibit, which file is generated by `ansible-builder` to support the build?

Accepted Answer

Containerfile. The `ansible-builder` tool uses a definition file (typically `execution-environment.yml`) to construct a container image. During the build process, it generates a `Containerfile` (or `Dockerfile`) that contains the exact instructions for building the container image, such as base image selection, package installation, and collection inclusion. This generated file is the actual artifact that the container runtime (e.g., Podman or Docker) uses to create the execution environment image.

Answer

requirements.yml

Answer

execution-environment.yml

Answer

ansible.cfg

Question 10

An administrator uses a rolling update strategy with serial: 3 and max_fail_percentage: 20. They have 10 hosts in the inventory. The first batch of 3 hosts: 2 succeed, 1 fails. What happens next?

Accepted Answer

The playbook continues with the next batch of 3 hosts.. The `max_fail_percentage` parameter applies to the total number of hosts, not per batch. With 10 hosts and 20%, up to 2 hosts can fail overall. The first batch had only 1 failure, which is within the limit, so the playbook continues with the next batch of 3 hosts. Options B, C, and D are incorrect because the failure threshold has not been exceeded.

Answer

The playbook retries the failed host, then continues.

Answer

The playbook marks the failed host as unreachable and continues.

Answer

The playbook aborts and no further hosts are updated.

Question 11

Match each Ansible module to its primary function.

Accepted Answer

yum: Manages packages using the yum package manager. The yum module manages packages, service manages system services, and copy transfers files from local to remote. Common confusions include swapping definitions or using the wrong direction for file transfers.

Answer

yum: Manages services (start, stop, restart, enable)

Answer

service: Manages packages using the yum package manager

Answer

copy: Copies files from remote to local hosts

Question 12

A user wants to use a collection from Automation Hub. Which command downloads and installs the collection to the default collections path?

Accepted Answer

ansible-galaxy collection install. The correct command to download and install a collection from Automation Hub to the default collections path is `ansible-galaxy collection install`. This command uses the `ansible-galaxy` utility, which is the standard tool for managing Ansible roles and collections, and the `collection install` subcommand specifically handles collection installation from configured sources like Automation Hub or Ansible Galaxy.

Answer

ansible-pull collection install

Answer

ansible-playbook collection install

Answer

ansible-collection install

Question 13

Which THREE of the following are valid ways to define host variables in an Ansible inventory? (Choose exactly three.)

Accepted Answer

Inline in the inventory file, e.g., 'myhost ansible_host=192.168.1.1 http_port=8080'.. Ansible allows inline host variable definitions directly in the inventory file using key=value pairs after the hostname. This is a standard syntax where variables like 'http_port=8080' are assigned to the host 'myhost' and become available as Ansible facts during playbook execution. The 'ansible_host' special variable is also defined this way to override the connection address.

Answer

In the 'extra_vars' field of the job template.

Answer

In a credential's 'Input Configuration' as a secret variable.

Question 14

Refer to the exhibit. A playbook already includes the 'common' role in its roles list. The current role depends on 'common' with 'allow_duplicates: false'. How many times will the 'common' role run?

Accepted Answer

Once.. The 'common' role is already listed in the playbook's roles list, and the current role declares a dependency on 'common' with 'allow_duplicates: false'. In Ansible, when a role dependency is defined with 'allow_duplicates: false', Ansible checks if the role has already been executed in the current play. Since 'common' is already in the roles list, it will not run again, resulting in a single execution.

Answer

Not at all.

Answer

Depends on the order of roles.

Answer

Twice.

Question 15

A company uses Ansible Automation Controller to manage a mix of Linux and Windows servers. Each server is in a separate inventory group. The Linux servers use SSH keys stored in machine credentials, and the Windows servers use username/password stored in machine credentials. Recently, a new security policy requires that all credentials must be rotated every 90 days. The automation team has 50 Linux servers and 20 Windows servers. They want to minimize manual effort and avoid exposing secrets in plain text during rotation. They currently have a Jenkins pipeline that can run scripts on the controller node. Which approach best meets the requirements?

Accepted Answer

Write a script that uses the Automation Controller API to update the credential's inputs (e.g., new SSH key or password) after rotating them on the target servers. It uses the Automation Controller API to programmatically update credential inputs (SSH keys or passwords) after rotating them on the target servers, which minimizes manual effort, avoids exposing secrets in plain text (the API call uses HTTPS and authentication tokens), and satisfies the 90-day rotation policy. The Jenkins pipeline can invoke a script that first rotates the secret on each server (e.g., via SSH or WinRM) and then calls the API's PATCH endpoint for the credential to update the stored value, ensuring the credential remains synchronized without manual UI intervention.

Answer

Use a Vault credential to store the new secrets and reference them in the job template

Answer

Store the new passwords directly in a playbook and run it manually on each server, then update the credential in the UI

Answer

Create a single machine credential with the same SSH key for all Linux servers and a single credential for all Windows servers