EX294 Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. An Ansible playbook targeting 'production' hosts fails with 'deploy_user is undefined'. What is the most likely cause?

Accepted Answer

the variable 'deploy_user' is not defined in any group or host vars. The error 'deploy_user is undefined' indicates that Ansible cannot find a value for the variable 'deploy_user' in any of the variable sources it searches. In Ansible, variables are resolved from group vars, host vars, play vars, and other sources with a specific precedence order. If the variable is not defined in any group or host vars file, nor in the inventory itself, Ansible will fail with an 'undefined variable' error. The exhibit shows a play targeting 'production' hosts, so the most likely cause is that no group or host var file defines 'deploy_user' for that group or its hosts.

Answer

the playbook uses a different group name in the play

Answer

the inventory file is missing the host entries

Answer

the variable is defined but overridden by a higher precedence variable

Question 2

An administrator is debugging a playbook that uses multiple roles and wants to limit execution to a specific set of tasks. Which three methods can be used to filter task execution? (Choose three.)

Accepted Answer

Use the '--tags' command-line option.. The '--tags' command-line option allows you to specify a subset of tasks to execute based on tags assigned to tasks or roles. When you run ansible-playbook with '--tags', only tasks that have a matching tag (or are tagged with 'always') will run, effectively filtering execution to a specific set of tasks.

Answer

Use the '--check' command-line option.

Answer

Use the '--step' command-line option.

Question 3

An Ansible playbook uses a rolling update strategy with serial: 1. After the first host is updated, the playbook stops and shows 'PLAY RECAP' with only one host. What is the most likely reason?

Accepted Answer

the inventory contains only one host. The `serial: 1` directive in Ansible limits concurrency to one host at a time, but the playbook will still process all hosts in the inventory. If the playbook stops after the first host and shows PLAY RECAP with only one host, the most likely reason is that the inventory contains only one host. With a single host, the play executes on that host and then finishes. Option B accurately identifies this scenario.

Answer

the playbook has a 'failed_when' condition that stops execution

Answer

the play uses 'delegate_to' incorrectly

Answer

the playbook does not have any task that triggers the next batch, and 'serial' only controls concurrency, not retry

Question 4

An Ansible role uses a variable "server_list" which is a list of dictionaries. Each dictionary has a key "ports" which should be a list of integers. However, due to inconsistent input, "ports" could be a comma-separated string (e.g., "80,443") or already a list of integers (e.g., [80,443]). The engineer wants to normalize "ports" to always be a list of integers for further processing. Which of the following tasks correctly normalizes the "ports" field?

Accepted Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': (item.ports is string) | ternary(item.ports | split(','), item.ports)}) }}"
  loop: "{{ server_list }}". It uses the `ternary` filter to check if `item.ports` is a string; if true, it splits the string by commas into a list, otherwise it keeps the existing list. This ensures the `ports` field is always normalized to a list of integers, handling both inconsistent input formats.

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports | split(',')}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': [item.ports] | flatten}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports}) }}"
  loop: "{{ server_list }}"

Question 5

A company is deploying Ansible Automation Platform (AAP) in a three-node cluster: one automation controller node, one private automation hub node, and one database node (PostgreSQL). The deployment uses an execution environment that pulls from the private automation hub. After a successful installation, all nodes are reachable and services are running. However, when launching a job template that uses the execution environment, the job fails with the error: 'Unable to pull execution environment image from automation-hub.example.com:5000/ee/my-ee:latest - request to registry failed with status 403 Forbidden'. The administrator confirms that the execution environment image exists in the private automation hub and that the automation controller node can reach the registry via curl. What is the most likely cause and solution?

Accepted Answer

Create a container registry credential in automation controller that uses the pull token from private automation hub, and associate it with the execution environment.. The 403 Forbidden error indicates that the automation controller cannot authenticate to the private automation hub container registry. Even though the image exists and network connectivity works, the controller needs a container registry credential configured with the pull token from the private automation hub. This credential must be associated with the execution environment. Option A is wrong because disabling authentication compromises security and is not the intended solution. Option B is wrong because SELinux would produce a different error (e.g., permission denied), not a 403. Option D is wrong because the 'pull' field does not affect authentication; the error is about authentication, not pull policy.

Answer

The private automation hub is configured to allow unauthenticated access; change the hub configuration to disable authentication.

Answer

SELinux on the controller node is blocking container pulls; temporarily set SELinux to permissive.

Answer

The execution environment definition in the controller is missing the 'pull' field; add 'pull: always' to the job template.

Question 6

Which TWO statements are true regarding the deployment of Ansible Automation Platform in a highly available configuration?

Accepted Answer

The automation controller requires a PostgreSQL database that must be configured with replication for high availability.. The automation controller in Ansible Automation Platform requires a PostgreSQL database, and for high availability (HA), that database must be configured with replication (e.g., streaming replication or Patroni) to ensure failover and data durability. Without database replication, a single database instance becomes a single point of failure, defeating the purpose of an HA deployment.

Answer

The automation hub requires an external PostgreSQL database to store collections and execution environments.

Answer

Execution nodes must have direct network access to the automation controller database.

Answer

The automation controller can use an embedded SQLite database for production deployments.

Question 7

Drag and drop the steps to configure SELinux to allow Apache to read a custom web directory in the correct order.

Accepted Answer

Create directory, set SELinux context, verify context, configure Apache, restart and test. SELinux for web: create dir, set context, verify, configure Apache, restart and test.

Answer

Create directory, configure Apache, set SELinux context, verify context, restart and test

Answer

Set SELinux context, create directory, verify context, configure Apache, restart and test

Answer

Create directory, verify context, set SELinux context, configure Apache, restart and test

Question 8

An Ansible task uses the variable `{{ my_var | default(required=true) }}`. What happens if `my_var` is undefined?

Accepted Answer

The task fails with an error message. The `default(required=true)` filter in Ansible explicitly marks the variable as required. If `my_var` is undefined, the filter raises an error because it enforces that the variable must be provided, causing the task to fail with an error message. This is a deliberate mechanism to catch missing mandatory variables early in playbook execution.

Answer

The task skips the host

Answer

The task uses an empty string

Answer

The task uses the string 'required'

Question 9

An Ansible playbook needs to extract the first line from a multi-line string variable 'output' and store it in a new variable 'first_line'. Which filter should be used?

Accepted Answer

{{ output | split('
') | first }}. The `split('
')` filter splits the multi-line string into a list of lines, and the `first` filter extracts the first element. This is the standard Ansible approach to isolate the first line from a string variable.

Answer

Answer

Answer

Question 10

A playbook uses the copy module to deploy a configuration file. The file should be templated with variables, but the engineer mistakenly uses the 'src' parameter with a static file instead of 'content' or a template module. What is the most likely outcome?

Accepted Answer

The file is copied without variable substitution, resulting in literal Jinja2 syntax in the destination.. The copy module with the 'src' parameter copies a file without any processing of Jinja2 templates. It does not perform variable substitution. Therefore, if the source file contains Jinja2 syntax (e.g., {{ variable }}), it will be copied literally to the destination. The correct answer is B. Option A is incorrect because the copy module does not automatically render templates. Option C is incorrect because the playbook will not fail due to undefined variables; it simply copies the file as-is. Option D is incorrect because the task will execute and copy the file, not skip.

Answer

The module automatically renders the Jinja2 template before copying.

Answer

The playbook fails because the source file contains undefined variables.

Answer

The task is skipped because copy cannot handle variables.

Question 11

Which TWO filters can be used to combine two lists into one? (Select exactly two.)

Accepted Answer

`zip`. (`zip`) is correct because the `zip` filter in Ansible combines two lists by pairing elements from each list into a single list of tuples, effectively merging them into one list. Option B (`union`) is correct because it merges two lists into a single list containing all unique elements from both. Option C (`intersect`) is incorrect because it only returns elements common to both lists, not a combination of all elements. Options D (`combine`) and E (`flatten`) are incorrect: `combine` works on dictionaries, not lists, and `flatten` reduces a nested list structure, it does not combine two lists.

Answer

`intersect`

Answer

`combine`

Answer

`flatten`

Question 12

A junior administrator is deploying Ansible Automation Platform (AAP) 2.3 on a fresh RHEL 9 server. They have downloaded the installer and edited the inventory file. The installation fails early in the process with: `TASK [private_automation_hub : Check that server_url has been configured]` and the error message: `FAILED - Could not connect to the Automation Hub server`. The inventory file has the following relevant lines: `automationhub_server_url=https://hub.example.com:443` and `automationhub_validate_certs=false`. The server `hub.example.com` is reachable from the installation node and responds with a 404 on the root path. The admin verified that the SSL certificate is self-signed. What should the admin do to resolve the issue?

Accepted Answer

Set `automationhub_server_url=https://hub.example.com/api/galaxy` to match the expected API path.. The Automation Hub server URL must point to the API endpoint, not the root path. The installer's `private_automation_hub` role checks for a valid response from `automationhub_server_url/api/galaxy/content/`, and a 404 on the root indicates the server is running but the URL is misconfigured. Setting the URL to `https://hub.example.com/api/galaxy` aligns with the expected API path, allowing the connectivity check to succeed.

Answer

Ensure that the hostname resolves to the correct IP address.

Answer

Add an `automationhub_token` value from the hub server.

Answer

Set `automationhub_validate_certs=true` and provide a CA certificate bundle.

Question 13

An Ansible playbook needs to convert a list of server names into a comma-separated string for an API call. Which filter should be applied to the list variable 'server_list'?

Accepted Answer

join(','). The `join` filter in Ansible is designed to concatenate list elements into a single string using a specified delimiter. Applying `join(',')` to `server_list` will produce a comma-separated string, exactly as required for the API call.

Answer

map('regex_replace', '^', '')

Answer

combine(',')

Answer

regex_replace('
', ',')

Question 14

A company uses Ansible to perform a rolling update of 10 web servers behind an HAProxy load balancer. The playbook uses the `serial` keyword and includes tasks to disable a host from the load balancer, update the web server package, and re-enable the host. Which TWO best practices should the administrator apply to minimize downtime and ensure a successful rolling update?

Accepted Answer

Set `serial: 1` to update one host at a time.. Setting `serial: 1` ensures that only one host is updated at a time, which is the safest way to perform a rolling update without overwhelming the load balancer or causing a service outage. This allows the playbook to complete the full update cycle (disable, update, re-enable) for each host before moving to the next, minimizing the number of hosts out of service simultaneously.

Answer

Use `any_errors_fatal: true` to stop the playbook if any host fails.

Answer

Use `throttle: 1` to limit the number of concurrent tasks across all hosts.

Answer

Use `async` and `poll` to run the update tasks in the background while proceeding to the next host immediately.

Question 15

A job template uses a custom credential type that injects environment variables for a third-party API. The credential input defines a field 'api_key'. The playbook uses {{ api_key }} but it's empty. What is the most likely cause?

Accepted Answer

The injector configuration is missing or incorrect.. The most likely cause is that the injector configuration is missing or incorrect. In Ansible Tower/AWX, a custom credential type requires an injector definition (e.g., `env` or `file`) to map the credential input fields into environment variables or extra vars. Without a proper injector, the `api_key` field is never exposed to the job environment, so `{{ api_key }}` resolves to an empty string.

Answer

The field name is case-sensitive and the playbook uses a different case.

Answer

The credential was not assigned to the job template.

Answer

The playbook uses a different variable name.