EX294 Practice Test 21 — 15 Questions

Question 1

A Red Hat Certified Engineer is deploying Ansible Automation Platform 2.4 on a RHEL 9 server. They extract the installer tarball and edit the inventory file. They set `registry_username` and `registry_password` in the inventory, then run `./setup.sh`. The installation fails early with an error that the subscription-manager repositories are not enabled. Which action most directly resolves this failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the RHEL system is registered with Red Hat Subscription Manager and the `ansible-automation-platform-2.4-for-rhel-9-x86_64-rpms` repository is enabled.. The AAP setup script depends on RHEL subscription repositories to install required packages. The system must be registered with RHSM and the appropriate AAP repository enabled. Without this, dependency resolution fails before configuration begins. Enabling the correct version-specific repository is the documented prerequisite and directly resolves the reported error.

Answer

Set `ansible_connection=local` in the installer inventory so the setup script uses the local RPM database.

Answer

Run the setup script with the `--skip-tags validation` flag to bypass the repository check.

Answer

Disable the firewall and SELinux on the server before rerunning the installer.

Question 2

An automation administrator is configuring an Ansible Automation Platform 2.4 controller to use an external PostgreSQL database. They have set `pg_host`, `pg_port`, `pg_database`, `pg_username`, and `pg_password` in the installer inventory. The installation fails with an error that the database user lacks the `CREATEDB` privilege. Which action should the administrator take?

Accepted Answer

Grant the `CREATEDB` privilege to the database user and re-run the installer.. The installer requires the external database user to have the `CREATEDB` privilege to create the automation controller and hub databases. Granting this privilege is the correct fix. Other options either ignore the privilege requirement, use an insecure workaround, or modify unrelated connection parameters.

Answer

Add `pg_sslmode='disable'` to the inventory to bypass SSL certificate validation.

Answer

Change `pg_host` to `localhost` to use a local socket connection instead of TCP.

Answer

Set `pg_username` to `postgres` and `pg_password` to the postgres superuser password.

Question 3

An administrator is deploying Ansible Automation Platform 2.4 with an external PostgreSQL database. The database administrator has created a database named `awx` and a user named `awx`, and has confirmed network connectivity from the AAP controller node to the database on port 5432. When the administrator runs the installer, the setup playbook fails during the database migration step with a permission error. Which configuration value is most likely missing or incorrect?

Accepted Answer

The `pg_hba.conf` on the database server does not permit the `awx` user to connect from the controller's IP address. When TCP connectivity to PostgreSQL is confirmed but the installer fails on database operations, the problem is almost always authorization. PostgreSQL's host-based authentication rules in `pg_hba.conf` determine whether the `awx` user may connect from the controller's address with the configured authentication method. Adding an appropriate host entry, then reloading PostgreSQL, resolves the migration failure.

Answer

The AAP installer requires the database password to be stored in an Ansible Vault file referenced by `vault_password_file` in the inventory

Answer

The `postgresql.conf` file on the database server has `listen_addresses` set to `localhost` only

Answer

The `awx` database was created with the `TEMPLATE template0` option instead of `TEMPLATE template1`

Question 4

An administrator is deploying a containerized Ansible Automation Platform 2.4 on a RHEL 9 host using the `ansible-container-installer`. After running the installation, the automation controller web UI is unreachable, and `podman ps` shows that the `automation-controller` container is in a restart loop. The administrator checks the container logs and sees repeated messages about failing to connect to the PostgreSQL database. The database container is running. Which action should the administrator take next?

Accepted Answer

Inspect the `automation-controller` container's environment variables to ensure the database hostname, port, username, and password match those configured for the PostgreSQL container.. In a containerized AAP deployment, the automation controller and PostgreSQL run as separate containers. The controller uses environment variables to locate and authenticate to the database. When the controller container enters a restart loop with database connection errors, the most likely cause is a mismatch in these environment variables. Verifying and aligning them with the database container's configuration restores connectivity and allows the controller to start successfully.

Answer

Increase the memory limit for the automation controller container by editing the `container.yml` file and re-running the installer.

Answer

Restart the PostgreSQL container with `podman restart postgresql` and then restart the automation controller container.

Answer

Verify that the `postgresql` container's data directory has the correct SELinux context and that the `container_manage_cgroup` boolean is enabled.

Question 5

An administrator maintains a project directory with an inventory file `inventory.ini` that contains a group `db_servers` with hosts `db1.example.com` and `db2.example.com`. The playbook `site.yml` must run only against these two hosts, but the inventory also contains other groups. The administrator wants to avoid modifying the inventory file and instead use a command-line option to limit execution to `db_servers`. Which command should be used?

Accepted Answer

ansible-playbook -i inventory.ini site.yml --limit db_servers. The --limit option is the correct way to restrict a playbook run to a subset of hosts defined in the inventory, such as a group. It overrides the play's host pattern without modifying the inventory or playbook. The other options either pass variables, control task execution, or filter tags, none of which select hosts. Thus, only --limit db_servers targets the intended group.

Answer

ansible-playbook -i inventory.ini site.yml --start-at-task db_servers

Answer

ansible-playbook -i inventory.ini site.yml -e "target=db_servers"

Answer

ansible-playbook -i inventory.ini site.yml --tags db_servers

Question 6

A systems administrator is preparing to install Red Hat Ansible Automation Platform 2.4 on a RHEL 9 server. They have downloaded the installer tarball and extracted it. Which file must they edit to specify the target hosts and authentication credentials for the installation?

Accepted Answer

`inventory`. The AAP installer requires an inventory file where you list the target hosts under specific groups and provide authentication variables such as `ansible_user` and `ansible_password`. This file is typically named `inventory` and is located in the installer directory. Editing it is mandatory before running `setup.sh` to ensure the installer can connect to and configure the hosts.

Answer

`group_vars/all.yml`

Answer

`ansible.cfg`

Answer

`setup.sh`

Question 7

An administrator is configuring a new Red Hat Ansible Automation Platform 2.5 installation and must connect the automation controller to a private automation hub so that certified and validated collections can be pulled during project syncs. The administrator wants the controller to authenticate to the hub and resolve collections automatically. Which TWO actions should the administrator take to accomplish this? (Choose two.)

Accepted Answer

Set the organization's Galaxy credential to the created hub credential and add the hub to the list of enabled Galaxy servers.. Connecting the controller to private automation hub requires a Galaxy/Automation Hub API Token credential holding the hub URL and token, plus assigning that credential to the organization and enabling the hub as a Galaxy server. Together these let project syncs authenticate and download certified or validated collections automatically.

Answer

Edit ansible.cfg on each execution node to add the private hub URL under the [galaxy_server] sections with a plaintext token.

Answer

Configure a webhook on the private automation hub that pushes collection metadata into the controller database on every change.

Answer

Publish the collections to the controller's local filesystem under /var/lib/awx/projects/collections and reference them with a relative path.

Question 8

An administrator is running `ansible-playbook -i inventories/prod site.yml` against the `prod` inventory, which contains a group `web` and a group `db`. The play is defined with `hosts: web:&db`. Which hosts will the play target?

Accepted Answer

All hosts that are in both the `web` group and the `db` group. The `:&` syntax in a host pattern performs set intersection, so the play runs only against hosts that are members of both the `web` and `db` groups. The `:` alone would create a union, and a leading `!` would exclude. Because the play uses `web:&db`, the correct target set is the overlap of the two groups.

Answer

All hosts in the inventory except those in the `web` and `db` groups

Answer

Only the first host listed in the `web` group that also appears in `db`

Answer

All hosts that are in the `web` group or in the `db` group

Question 9

A playbook run against a Windows host fails at the connection stage with an authentication error, although the inventory specifies `ansible_user: Administrator` and the correct password. Which inventory variable must be set so that Ansible uses the password-based WinRM connection instead of trying Kerberos or certificate authentication?

Accepted Answer

ansible_winrm_transport: ntlm. For Windows targets, authentication over WinRM is governed by `ansible_winrm_transport`. With a username and password and no Kerberos infrastructure, setting it to `ntlm` forces NTLM authentication and resolves the connection failure. Connection type, SSH password, and become settings do not select the WinRM authentication protocol.

Answer

ansible_become: true

Answer

ansible_ssh_pass: <password>

Answer

ansible_connection: winrm

Question 10

You run 'ansible-playbook -i inventory site.yml' and notice that a host defined in the inventory file is not targeted by a play with 'hosts: all'. The inventory file contains a group named 'ungrouped' with several hosts and a group named 'all_servers' with the same hosts. Which command most directly reveals whether Ansible is parsing the intended inventory source and listing that host under the expected groups?

Accepted Answer

ansible-inventory -i inventory --list. The ansible-inventory --list command is designed to parse an inventory source and emit the resulting groups, hosts, and variables as JSON. It is the definitive tool for confirming how Ansible interprets an inventory file, including group membership and host listing.

Answer

ansible-config dump --only-changed

Answer

ansible all -i inventory -m ping

Answer

ansible-doc -t inventory -l

Question 11

A playbook reads a JSON inventory file with `lookup('file', 'hosts.json') | from_json` and registers it as `hostdata`. The structure is a top-level dictionary where each key is a hostname and each value is a dictionary of attributes, for example `{"web1": {"env": "prod", "cpu": 4}, "db1": {"env": "dev", "cpu": 8}}`. You must build a list containing only the hostnames whose `env` attribute equals `prod`. Which task correctly produces that list?

Accepted Answer

- set_fact:
    prod_hosts: "{{ hostdata | dict2items | selectattr('value.env', 'equalto', 'prod') | map(attribute='key') | list }}". Because the source is a dictionary keyed by hostname, it must first be turned into an iterable list of pairs with `dict2items`. Each pair then exposes the hostname as `key` and the attribute dictionary as `value`, so the environment test must reference `value.env`. Extracting `key` afterwards yields exactly the list of prod hostnames the task requires.

Answer

- set_fact:
    prod_hosts: "{{ hostdata | dict2items | selectattr('value.env', 'equalto', 'prod') | map(attribute='value') | list }}"

Answer

- set_fact:
    prod_hosts: "{{ hostdata | dict2items | selectattr('env', 'equalto', 'prod') | map(attribute='key') | list }}"

Answer

- set_fact:
    prod_hosts: "{{ hostdata | selectattr('env', 'equalto', 'prod') | map(attribute='name') | list }}"

Question 12

A junior administrator needs to create an encrypted Ansible Vault password file for use with ansible-playbook. The vault password must be stored in a file named vault_pass.txt in the current directory. Which command should the administrator run?

Accepted Answer

echo 'mysecretpassword' > vault_pass.txt. A vault password file is a plaintext file that contains the vault password on its first line. It is created using standard file redirection or an editor, not with ansible-vault commands. This file is then referenced with --vault-password-file during playbook runs to decrypt vault-encrypted content non-interactively.

Answer

ansible-vault create vault_pass.txt

Answer

ansible-vault encrypt --vault-password-file vault_pass.txt

Answer

ansible-vault encrypt_string --vault-password-file vault_pass.txt

Question 13

An organization runs Red Hat Ansible Automation Platform 2.5 with a containerized automation controller. Administrators want job output and automation logs centralized so that a security team can search historical runs and correlate them with SIEM events. Which supported capability should the administrator configure to forward controller logs to an external logging endpoint?

Accepted Answer

Configure the controller's external logging settings to send activity stream and job output to a syslog or aggregator endpoint.. Automation controller includes external logging configuration that forwards activity stream data and job events to syslog, Splunk, Elastic, or other aggregators. Enabling it centralizes logs for search and SIEM correlation without custom plugins, host mounts, or API polling jobs.

Answer

Mount the controller container's /var/log/tower directory onto the host and ship those files with a log forwarder.

Answer

Enable the callback plugin in each project's ansible.cfg so every task posts its result to a remote HTTP endpoint.

Answer

Create a scheduled job template that queries the controller API for job events and writes them to a shared NFS export.

Question 14

An administrator maintains a dynamic inventory script that outputs JSON. The script is placed at `/etc/ansible/inventory/aws_inventory.py` and is executable. The administrator runs `ansible-playbook -i /etc/ansible/inventory/aws_inventory.py site.yml` but receives an error: "Unable to parse /etc/ansible/inventory/aws_inventory.py as an inventory source". Which action is most likely to resolve the issue?

Accepted Answer

Ensure the script outputs a JSON object with a top-level key `_meta` containing `hostvars`, and that the script supports the `--list` argument.. Dynamic inventory scripts must be executable and support the --list argument, returning valid JSON with groups and hosts. The _meta key with hostvars is recommended to avoid separate --host calls. The parse error typically occurs when the script fails to output valid JSON or does not handle --list. The other options either misrepresent how Ansible detects dynamic inventories or take actions that would not fix the script's output.

Answer

Change the script's file extension to .json so Ansible recognizes it as a JSON inventory.

Answer

Make the script non-executable and pass it as a static inventory file.

Answer

Add the script path to the `inventory` setting in ansible.cfg and remove the -i option from the command.

Question 15

An administrator runs a playbook with the serial keyword set to 2. The playbook targets 6 hosts and contains a task that runs a rolling update. During execution, the administrator notices that the task is executed on only 2 hosts at a time, but the playbook waits for all tasks to complete on those 2 hosts before moving to the next 2. What is the primary effect of the serial keyword in this scenario?

Accepted Answer

It limits the number of hosts that execute each task concurrently, processing hosts in batches.. The serial keyword controls how many hosts are included in each batch of a play. When set to 2, Ansible completes the entire play on the first 2 hosts before moving to the next 2. This provides rolling updates and limits the impact of failures. It does not affect parallelism within a batch or limit the total number of hosts.

Answer

It ensures that only 2 tasks are executed at a time on each host.

Answer

It sets the maximum number of forks used for parallel task execution across all hosts.

Answer

It restricts the play to run on only 2 hosts total, ignoring the rest.