EX294 Practice Test 24 — 15 Questions

Question 1

A team is writing an Ansible role to configure a web server. They want to include default variables that can be easily overridden by playbook variables. Which directory and file should they use to define these variables?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

defaults/main.yml. In Ansible roles, default variables are defined in the `defaults/main.yml` file. These variables have the lowest precedence, meaning they can be easily overridden by playbook variables, inventory variables, or any other variable source with higher precedence. This design allows role authors to provide sensible defaults while giving users the flexibility to customize behavior without modifying the role itself.

Answer

vars/defaults.yml

Answer

default_vars/main.yml

Answer

vars/main.yml

Question 2

During a playbook execution, a task that uses the 'ansible.builtin.copy' module fails with 'Permission denied' on a remote host. The playbook runs as user 'ansible' which is a sudoer without password. Which of the following is the most likely cause and solution?

Accepted Answer

The task lacks 'become: yes' but has 'become_user: root'. Add 'become: yes' to the task.. The 'Permission denied' error occurs because the task attempts to copy a file to a location that requires root privileges, but the playbook does not use privilege escalation. The user 'ansible' is a passwordless sudoer, so adding 'become: yes' to the task enables sudo, granting the necessary permissions to write to the destination. Option C correctly identifies this missing directive.

Answer

The remote path does not exist. Use 'remote_src: yes' to copy from remote.

Answer

The local source file is not readable by the user running ansible-playbook. Change permissions on the source file.

Answer

The remote file is owned by root and the destination directory is not writable by ansible. Use 'become: yes' and set 'owner: ansible'.

Question 3

An Ansible playbook needs to ensure a service is enabled and running on boot. Which combination of parameters should be used with the 'systemd' module?

Accepted Answer

enabled: yes, state: started. The 'systemd' module in Ansible requires both 'enabled: yes' to set the service to start on boot and 'state: started' to ensure the service is currently running. This combination directly fulfills the requirement of ensuring a service is enabled and running on boot.

Answer

enabled: yes, state: reloaded

Answer

enabled: yes, daemon_reload: yes

Answer

enabled: yes, state: restarted

Question 4

You are managing a critical web application deployed on OpenShift with 12 replicas. The application must maintain at least 10 replicas available during updates to meet an SLA. You initiate a rolling update using the default strategy, but the rollout is progressing slowly because only 2 new pods are created at a time, causing a prolonged update duration. You need to speed up the rollout without violating the SLA (10 available replicas). The current Deployment configuration has maxSurge: 25% (3 pods) and maxUnavailable: 25% (3 pods). You have permission to update the DeploymentConfig during the active rollout. Which action should you take?

Accepted Answer

Set maxSurge to 10 and maxUnavailable to 2, then run 'oc rollout resume'.

Answer

Cancel the current rollout, set maxSurge to 4 and maxUnavailable to 2, then start a new rollout.

Answer

Set maxSurge to 50% and maxUnavailable to 50%, then run 'oc rollout resume'.

Answer

Set maxSurge to 5 and maxUnavailable to 2, then run 'oc rollout retry'.

Question 5

Your organization uses Red Hat Ansible Automation Platform (AAP) to manage job execution. You have created a job template that runs a playbook to configure application servers. The playbook uses a custom credential to access a remote database. Recently, the job started failing with 'Authentication failed' when connecting to the database. You have verified that the database credentials are correct. The credential in AAP is of type 'Machine' and is assigned to the job template. The playbook uses the 'mysql_db' module. Which step should you take to troubleshoot and resolve the issue?

Accepted Answer

Change the credential type to 'Database' and provide the appropriate username and password.. The credential type 'Machine' is used for SSH or WinRM connections to hosts. The 'mysql_db' module requires database credentials to connect to a MySQL database, not SSH credentials. The correct credential type is 'Database', which provides the username and password for direct database access. Changing the credential type to 'Database' and assigning it to the job template resolves the authentication failure. Option B is incorrect because extra variables do not change the credential type; the module still looks for a credential of the appropriate type. Option C is incorrect because machine credentials do not support SSH keys for database passwords. Option D is incorrect because Ansible Vault encrypts data but does not change the credential type needed by the module.

Answer

Add the database password as an extra variable in the job template.

Answer

Modify the machine credential to include the database password as an SSH key.

Answer

Encrypt the database password using Ansible Vault and include it in the playbook.

Question 6

Which TWO of the following are valid methods to install a collection from a private Automation Hub?

Accepted Answer

Configure `server_list` in `ansible.cfg` under `[galaxy]` with the Automation Hub URL and then run `ansible-galaxy collection install my_namespace.my_collection`.. Configuring the `server_list` in `ansible.cfg` under the `[galaxy]` section allows you to define multiple Galaxy servers, including a private Automation Hub. Once configured, `ansible-galaxy collection install` will automatically use the specified server list to resolve and install the collection. Option D is also correct because the `--server` flag directly specifies the Automation Hub URL, overriding any default server configuration for that single command.

Answer

`ansible-galaxy collection install my_namespace.my_collection --server automationhub`

Answer

`ansible-navigator run --pp never --pull-policy missing -- ... `

Answer

Download the tarball and place it in the `collections/` directory of the role path.

Question 7

Refer to the exhibit. A user attempts to download the collection using the download URL but the signature verification fails. What is the most likely reason?

Accepted Answer

The user's client does not have the corresponding public key.. B is correct because signature verification of a downloaded collection requires the client to have the corresponding public key that was used to sign the collection. If the user's client lacks this public key, the verification process will fail, even if the collection itself is properly signed and the URL is valid.

Answer

The collection version does not match.

Answer

The collection is not properly signed.

Answer

The download URL is invalid.

Question 8

Your team manages a fleet of 200 Red Hat Enterprise Linux 8 servers. Security policy requires that all servers have a specific set of security configurations: (1) SELinux must be enforcing, (2) the firewall must allow only SSH and HTTPS, (3) SSH root login must be disabled, and (4) the 'auditd' service must be running and enabled. You have created an Ansible role 'security-hardening' that applies these settings. The role is idempotent and uses the 'lineinfile' module to modify /etc/ssh/sshd_config, the 'firewalld' module to configure firewall rules, the 'selinux' module to set SELinux to enforcing, and the 'service' module to enable and start auditd. You run the playbook against a test group of 10 servers, and it reports 'changed=0' for all tasks, indicating the servers are already compliant. However, a subsequent manual audit reveals that on two servers, SELinux is permissive and SSH root login is still permitted. What is the most likely cause of this discrepancy?

Accepted Answer

The inventory hostnames for those two servers are incorrect, causing Ansible to connect to different hosts that are already compliant.. If the inventory hostnames for the two non-compliant servers are incorrect, Ansible would connect to different hosts that are already compliant, resulting in 'changed=0' for all tasks. The playbook never actually ran against the intended servers, so the manual audit correctly found them non-compliant. This is a common inventory misconfiguration issue where the target hostname does not match the actual server.

Answer

The 'become' privilege escalation is not configured, so the tasks cannot modify system files.

Answer

The playbook was run with the '--check' flag, which simulates changes without applying them.

Answer

The Ansible modules used in the role are not installed on the control node.

Question 9

A playbook uses the 'include_tasks' module to load platform-specific tasks. The playbook fails intermittently with 'Could not find or access file' error on some runs but works on others. Which of the following is the most likely cause?

Accepted Answer

The 'include_tasks' is used with a loop and the loop variable shadows the included file's parameter.. When 'include_tasks' is used inside a loop, the loop variable (e.g., 'item') can override or shadow the parameters expected by the included task file. This causes the included file to receive unexpected variable values, leading to incorrect file path resolution and intermittent 'Could not find or access file' errors depending on the loop iteration.

Answer

The 'include_tasks' is used inside a block that has 'always' section.

Answer

The task file path is not absolute and Ansible's search order is inconsistent.

Answer

The playbook uses 'any_errors_fatal: true' causing early exits.

Question 10

A playbook uses the 'debug' module to print a variable 'myvar' which is a list of dictionaries. The output shows 'VARIABLE IS UNDEFINED' despite the variable being defined earlier. Which filter issue is most likely?

Accepted Answer

The variable is defined in a role but the playbook uses include_role incorrectly.. When a variable is defined inside a role but the playbook uses `include_role` incorrectly (e.g., without `tasks_from` or with a static import instead of dynamic include), the variable may not be available in the play's variable scope. The `debug` module then reports 'VARIABLE IS UNDEFINED' because the variable was never loaded into the play's namespace. This is a common scoping issue with role variables and dynamic includes.

Answer

The debug task uses 'var: myvar' instead of 'msg: "{{ myvar }}"'.

Answer

The playbook uses 'set_fact' with quotes around the variable name.

Answer

The variable contains a fact that is only available on the control node.

Question 11

Which lookup plugin is used to retrieve values from an AWS SSM Parameter Store?

Accepted Answer

`aws_ssm`. The `aws_ssm` lookup plugin is the correct choice because it is the official Ansible lookup plugin designed to retrieve values from the AWS Systems Manager Parameter Store. It is part of the `amazon.aws` collection and is invoked via `lookup('aws_ssm', 'parameter_name')` in playbooks.

Answer

`ssm`

Answer

`amazon_ssm`

Answer

`ssm_parameter`

Question 12

A Red Hat Ansible Automation Platform installation uses a custom execution environment. The playbook runs fail with 'execution environment not found'. The execution environment is stored in a private registry requiring authentication. What must be configured?

Accepted Answer

Add the registry URL to the automation controller's container registry credentials. When an execution environment is stored in a private registry that requires authentication, the automation controller must have the registry's URL and credentials configured as a container registry credential. This credential is then used by the controller to authenticate and pull the execution environment image during job runs. Without this, the controller cannot access the private registry, resulting in the 'execution environment not found' error.

Answer

Set the execution_environment_image variable in the playbook

Answer

Configure the execution environment in the inventory

Answer

Add the registry to the project's source control

Question 13

An organization uses a private Automation Hub. A user has configured the server in ansible.cfg. Which command installs a collection from this server?

Accepted Answer

ansible-galaxy collection install my_namespace.my_collection. When the Automation Hub server is already configured in ansible.cfg under the [galaxy] section with the server_url and auth_url, the ansible-galaxy collection install command will automatically use that server and its authentication. No additional flags are needed; the command simply specifies the collection name in the format namespace.collection.

Answer

ansible-galaxy collection install my_namespace.my_collection --api-key=mykey

Answer

ansible-galaxy collection install my_namespace.my_collection --server=https://privatehub.example.com

Answer

ansible-galaxy collection download my_namespace.my_collection

Question 14

An Ansible Tower administrator needs to create a custom credential type that uses an SSH private key and a username. Which THREE components should be defined in the credential type's configuration?

Accepted Answer

"fields": [{"id": "ssh_key_data", "type": "string", "label": "SSH Private Key", "multiline": true, "secret": true}]. The SSH private key must be defined as a field with `"type": "string"`, `"multiline": true` (since SSH keys are multi-line), and `"secret": true` (to encrypt the value in the database). This matches the standard Ansible Tower custom credential type schema for storing sensitive key material.

Answer

"fields": [{"id": "password", "type": "string", "label": "Password"}]

Answer

"fields": [{"id": "key_type", "type": "string", "label": "Key Type"}]

Question 15

An Ansible playbook fails intermittently when deploying web servers. The error message indicates that a required package is not available in the repository. Which approach would best ensure that the required packages are consistently available before the playbook runs?

Accepted Answer

Add a pre_task to run 'dnf update' or 'apt update' before the package installation.. The intermittent failure is caused by the package metadata cache being stale or missing. Running 'dnf update' (RHEL/CentOS) or 'apt update' (Debian/Ubuntu) as a pre_task refreshes the repository index, ensuring that the package manager has the latest list of available packages before attempting installation. This directly resolves the 'package not available' error by synchronizing the local cache with the remote repository.

Answer

Set 'ignore_errors: yes' on the package installation task and handle the failure later.

Answer

Add retries and delay to the package installation task.

Answer

Use the 'get_url' module to download the package from an external source and install it manually.