EX294 Practice Test 24 — 15 Questions

Question 1

A playbook uses the copy module to deploy a configuration file. The file should be templated with variables, but the engineer mistakenly uses the 'src' parameter with a static file instead of 'content' or a template module. What is the most likely outcome?

Accepted Answer

The file is copied without variable substitution, resulting in literal Jinja2 syntax in the destination.. Option A is correct because copy with src copies the file as-is, no variable substitution. Option B is wrong because the module does not fail on static content. Option C is wrong because it won't automatically render variables; that requires template module. Option D is wrong because it will copy the file, not skip.

Answer

The module automatically renders the Jinja2 template before copying.

Answer

The playbook fails because the source file contains undefined variables.

Answer

The task is skipped because copy cannot handle variables.

Question 2

Given the inventory above, which user will Ansible use when connecting to 'web2'?

Accepted Answer

deploy. Option C is correct because the group vars for webservers set ansible_user=deploy. Option A is wrong because host vars are not set. Option B is wrong because root is default only if not set. Option D is wrong because dbadmin is for dbservers.

Answer

dbadmin

Answer

The system default user from ansible.cfg.

Answer

root

Question 3

A playbook uses the 'block' and 'rescue' keywords. If a task in the block fails, but the rescue tasks also fail, what happens?

Accepted Answer

The play fails.. Option B is correct because if rescue also fails, the overall play fails. Option A is wrong because rescue failure propagates. Option C is wrong because no automatic retry. Option D is wrong because block is not re-executed.

Answer

The play continues to the next task.

Answer

The block is re-executed.

Answer

The rescue tasks are retried.

Question 4

An Ansible playbook uses delegation to run a task on localhost while targeting remote hosts. The task fails with 'connection refused' for the remote host. What is the most likely cause?

Accepted Answer

the task uses 'connection: local' incorrectly or omits it. Option B is correct because 'delegate_to: localhost' runs the task locally, but the connection keyword 'ansible_connection' may still refer to remote if not set correctly. Option A is plausible but less common. Options C and D are incorrect.

Answer

the remote host is not reachable from the control node

Answer

the playbook lacks 'gather_facts: yes'

Answer

the delegate host lacks required Python libraries

Question 5

An organization uses separate network hops that require different SSH usernames for different inventory groups. Which Ansible configuration approach ensures each group uses the correct SSH user without duplicating playbooks?

Accepted Answer

Create a group_vars directory with a file named after the group containing ansible_user.. Option D is correct because group_vars files can set ansible_user per group. Option A is wrong because ansible.cfg applies globally. Option B is wrong because it's not best practice and can be overridden. Option C is wrong because inventory file is less scalable.

Answer

Specify the SSH user in the inventory file for each host.

Answer

Set the ansible_user variable in ansible.cfg.

Answer

Define ansible_user in the playbook using vars.

Question 6

The playbook above fails with 'template source file not found' for the copy task. Which change should be made to fix it?

Accepted Answer

Use the 'template' module instead of 'copy' for .j2 files.. Option D is correct because the template module should be used to render .j2 files. Option A is wrong because the file exists on the control node, not remote. Option B is wrong because backup is not related. Option C is wrong because facts are not required to find the source.

Answer

Add 'delegate_to: localhost' to copy the file from the control node.

Answer

Set 'backup: no' because backup creates additional files.

Answer

Set 'gather_facts: yes' to allow Ansible to locate the template.

Question 7

Which two statements about Ansible roles are correct? (Select exactly 2.)

Accepted Answer

Roles can include tasks, handlers, variables, and defaults.. Options A and D are correct. Roles can contain tasks, handlers, variables, and defaults. Roles can be installed from Ansible Galaxy. Option B is false because roles can be used with include_role. Option C is false because meta/main.yml is optional. Option E is false because roles are not playbooks.

Answer

Roles must have a meta/main.yml file.

Answer

Roles are a type of playbook.

Answer

Roles cannot be used with include_role.

Question 8

Refer to the exhibit. The playbook copies all .conf files from the control node to host1. If the playbook runs again on the same host without any changes, which task status is expected?

Accepted Answer

All items will show 'ok' because files are identical.. The copy module uses checksums to detect changes. If the files are identical, the task will report 'ok' (not 'changed'). However, the with_fileglob lookup runs on the control node and will always return the same list. The copy module will compare each file and report 'ok' if unchanged.

Answer

The task will fail because the destination directory already contains files.

Answer

The task will be skipped because the files already exist.

Answer

All items will show 'changed'.

Question 9

Refer to the exhibit. The playbook fails because the httpd package is not found. Which is the most likely cause?

Accepted Answer

The target host does not have the necessary repositories enabled.. The error indicates the package is not available. This is typically due to missing or incorrect repository configuration. The playbook itself and role syntax are valid.

Answer

The inventory does not define 'webservers' group.

Answer

The role path is incorrectly configured in ansible.cfg.

Answer

The 'yum' module should use 'name=httpd' instead of YAML syntax.

Question 10

An automation team wants to securely store SSH private keys for use in playbooks. Which Ansible feature should they use?

Accepted Answer

Ansible Vault. Ansible Vault is the correct feature for securely storing SSH private keys because it encrypts sensitive data at rest using AES-256, allowing keys to be decrypted at runtime when a vault password or key is provided. This enables playbooks to reference encrypted SSH key files without exposing plaintext credentials in version control or on disk.

Answer

Ansible Collections

Answer

Ansible Fact Cache

Answer

Ansible Galaxy

Question 11

Refer to the exhibit. An administrator deployed this configuration using the controller_configuration role. After deployment, user jdoe can administer Engineering organization but cannot launch a job template within it. What is the most likely reason?

Accepted Answer

The user needs to be added to the job template's role specifically. Option C is correct because in Ansible Tower/AWX, organization-level admin roles grant administrative privileges over the organization's objects (e.g., users, teams, inventories) but do not automatically confer execute permissions on specific job templates. To launch a job template, a user must have the 'execute' role on that job template itself, either directly or via a team or user role assignment. Since user jdoe can administer the Engineering organization but cannot launch a job template, the missing piece is the explicit job template role assignment.

Answer

The admin role for organization does not include job template launch permissions

Answer

The user's password is vault-encrypted and cannot be decrypted

Answer

The role assignment should be at the team level, not user level

Question 12

A playbook fails with 'ERROR! 'become' is not a valid attribute for a Play'. What is the most likely cause?

Accepted Answer

The playbook uses an older syntax that requires 'sudo'. Option D is correct because in older versions of Ansible (prior to 2.0), privilege escalation was handled using the 'sudo' keyword at the play level. The error 'become' is not a valid attribute for a Play' indicates that the playbook is using the modern 'become' directive at the play level, but the installed Ansible version (likely 1.x) does not support it. The correct syntax for that version would be 'sudo: yes'.

Answer

The playbook lacks a hosts line

Answer

The become directive is misspelled

Answer

become is allowed only in tasks, not plays

Question 13

Refer to the exhibit. An automation job failed with the given error. What is the most likely cause?

Accepted Answer

The SSH key is not authorized for the remote user. The error message indicates an SSH authentication failure, which occurs when the SSH key presented by the control node is not authorized for the remote user's account. This is the most likely cause because Ansible relies on SSH key-based authentication by default, and a missing or mismatched public key on the remote host will prevent the connection.

Answer

The playbook syntax is incorrect

Answer

The SSH port is blocked

Answer

The remote host is unreachable

Question 14

An organization uses Automation Controller with multiple teams. They want to ensure that team members can only launch job templates that are explicitly assigned to their team. Which configuration approach should be used?

Accepted Answer

Create roles and assign them at the job template level using team roles. Option D is correct because Automation Controller (formerly Ansible Tower) uses Role-Based Access Control (RBAC) where roles (e.g., Execute, Admin) can be assigned to teams at the job template level. This ensures that only members of a specific team can launch the job templates explicitly assigned to that team, without affecting other teams or requiring organization-wide permissions.

Answer

Assign each team to an organization and set organization-level permissions

Answer

Set 'allow simultaneous' to false on job templates

Answer

Use an Identity Provider (IdP) to restrict access

Question 15

Which two actions are appropriate when configuring a custom execution environment for an automation controller job? (Choose two.)

Accepted Answer

Building the execution environment using ansible-builder. Option B is correct because `ansible-builder` is the official tool for building custom execution environments, which are container images that include Ansible, collections, and dependencies needed for automation controller jobs. Option E is correct because a Containerfile (or Dockerfile) defines the base image, packages, and Python dependencies required for the custom execution environment, and it is used by `ansible-builder` or directly with `podman build` to create the image.

Answer

Storing the execution environment in a public registry only

Answer

Setting the execution_environment_image in the project's SCM

Answer

Using the default execution environment provided by controller