EX294 Practice Test 24 — 15 Questions

Question 1

An Ansible playbook uses a custom filter plugin located in the `filter_plugins/` directory next to the playbook. The filter is not being applied, and the playbook fails with an error that the filter is undefined. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The filter plugin file must define a `FilterModule` class with a `filters` method.. Filter plugins require a specific structure: a `FilterModule` class with a `filters` method that returns a dictionary mapping filter names to functions. Without this, Ansible cannot register the filter, leading to an undefined filter error. The directory location and file extension are correct, so the structure is the likely culprit.

Answer

The filter plugin must be written in Python and have a `.py` extension.

Answer

The `filter_plugins` directory must be specified in `ansible.cfg` using `filter_plugins = ./filter_plugins`.

Answer

The filter plugin must be placed in a `library` directory instead of `filter_plugins`.

Question 2

A playbook must normalize a list of dictionaries read from a YAML file. Each dictionary has keys 'name' and 'ports', where 'ports' is a comma-separated string such as '80,443'. You need to produce a new list where each dictionary has the same 'name' but 'ports' is a list of integers. Which TWO filter usages are required to accomplish this transformation? (Choose two.)

Accepted Answer

map('int') applied to the resulting token list to convert each string to an integer.. Converting a comma-separated string into a list of integers requires two distinct operations. Splitting on the comma produces string tokens, and mapping the int filter over those tokens converts each to a number. Together they yield the desired list of integer ports, which can then be assembled into each dictionary entry, satisfying the normalization requirement without manual iteration.

Answer

select('match', '^[0-9]+$') applied to the tokens to filter valid ports.

Answer

json_query('ports') applied to each dictionary to extract the ports field as a list.

Answer

combine() applied to the dictionaries to merge the new ports list into each entry.

Question 3

A developer is creating a new content collection named acme.tools to distribute internal modules and roles. Which command initializes the collection with the standard directory skeleton, including the galaxy.yml metadata file?

Accepted Answer

ansible-galaxy collection init acme.tools. To scaffold a new collection, use ansible-galaxy collection init followed by the namespace and collection name. This generates the standard directory layout and the galaxy.yml metadata file that describes the collection. Other ansible-galaxy subcommands such as build and publish operate on an existing collection, and ansible-builder is unrelated to collection initialization.

Answer

ansible-galaxy collection create acme.tools

Answer

ansible-builder create acme.tools

Answer

ansible-galaxy init acme.tools --type collection

Question 4

You are creating a new Ansible content collection named 'acme.corp' using the ansible-galaxy collection init command. After running the command, you need to add a module that will be part of this collection. Where should you place the module file within the collection directory structure?

Accepted Answer

In the plugins/modules directory.. Ansible collections have a defined structure where plugins, including modules, are stored under the plugins directory. Modules specifically go in plugins/modules. This structure allows Ansible to automatically discover and load the module when the collection is installed, making it available for use in playbooks via the collection's fully qualified name.

Answer

In the roles directory under a role named after the module.

Answer

In the library directory at the root of the collection.

Answer

In the modules directory at the root of the collection.

Question 5

Your team maintains a collection that depends on a module requiring the Python library netaddr. You are building an execution environment with ansible-builder and need that library available inside the image at run time. The collection itself is installed from a private Automation Hub. Which approach ensures the Python dependency is present in the execution environment?

Accepted Answer

Add netaddr to the requirements.txt referenced by the dependencies.python section of execution-environment.yml.. Python libraries needed by modules must be installed into the execution environment image during the build. The dependencies.python section of execution-environment.yml references a pip requirements file, and listing netaddr there causes ansible-builder to install it into the image. Collection metadata and Galaxy dependency lists do not install Python packages, and installing on the control node has no effect inside the container.

Answer

List netaddr under dependencies.galaxy in execution-environment.yml so ansible-galaxy installs it with the collection.

Answer

Install netaddr on the control node and rely on the module using the control node's Python environment.

Answer

Add netaddr to the collection's runtime.yml under the requires_ansible key.

Question 6

A template must display the value of a variable named app_port. If app_port is undefined, the template should render the number 8080 instead of failing. Which expression accomplishes this using an Ansible filter?

Accepted Answer

{{ app_port | default(8080) }}. Providing a fallback for an undefined variable in a template is exactly what the default filter handles. When app_port is absent from the variable namespace, default(8080) supplies the specified value, allowing the template to render successfully. Other filters either raise errors, produce non-numeric placeholders, or require conditional arguments, so they do not meet the requirement.

Answer

Answer

Answer

Question 7

Refer to the exhibit. The playbook uses the 'yum' module to install 'httpd' on a RHEL 8 system. Which of the following is the most likely cause of the failure?

Accepted Answer

The AppStream repository is not enabled on the target host.. On RHEL 8, the `yum` command is a symbolic link to `dnf`, and the `yum` Ansible module internally uses `dnf` as the backend. The most common cause of failure when installing a package like `httpd` on RHEL 8 is that the AppStream repository (which contains `httpd`) is not enabled or available on the target host. Without an enabled repository containing the package, the module cannot resolve and install it, leading to a failure.

Answer

The 'yum' module is deprecated for RHEL 8; must use 'dnf'.

Answer

The remote host does not have subscription-manager access.

Answer

The package name is misspelled; it should be 'apache2'.

Question 8

A playbook includes a role that has a task notifying a handler defined within the role. Another task in the play, outside the role, also notifies the same handler by name. After running the playbook, the administrator notices that the handler runs only once. What is the reason for this behavior?

Accepted Answer

Handlers are executed only once per play, even if notified multiple times.. Handlers in Ansible are run once per play at the end, even if notified multiple times. This is by design to avoid multiple restarts of a service. The handler's scope is not limited to the role; it can be notified from anywhere in the play. The correct explanation is that handlers are deduplicated and executed once.

Answer

Handlers are executed immediately when notified, so the first notification triggers it and the second is ignored.

Answer

The handler runs only if the notifying task reports a changed status, and both tasks reported 'ok'.

Answer

The handler is scoped to the role and cannot be notified from outside the role.

Question 9

A playbook uses a task with 'delegate_to: localhost' to generate a report file. The task must run only once, even if the play targets multiple hosts. Which keyword should be added to the task to ensure it executes only on the first host?

Accepted Answer

run_once: true. The run_once keyword ensures the task is executed only on the first host in the play, regardless of how many hosts are targeted. When combined with delegate_to: localhost, the task runs once on the control node, generating a single report. Other keywords like serial, throttle, or any_errors_fatal affect batching, concurrency, or error handling, not single execution.

Answer

throttle: 1

Answer

any_errors_fatal: true

Answer

serial: 1

Question 10

You are preparing to publish a new version of a content collection to a private Automation Hub. The collection includes several roles and modules. Before publishing, you need to ensure the collection is properly built and packaged. Which two commands are required to build and publish the collection? (Choose two.)

Accepted Answer

ansible-galaxy collection build. To publish a collection to Automation Hub, you first build it into a tarball using ansible-galaxy collection build, then publish that tarball using ansible-galaxy collection publish. These two commands form the standard build and publish workflow, ensuring the collection is packaged correctly and uploaded to the repository.

Answer

ansible-galaxy collection install

Answer

ansible-galaxy collection verify

Answer

ansible-galaxy collection init

Question 11

An automation controller administrator needs to allow a team of developers to run playbooks that use a vault-encrypted variable file. The vault password must not be stored in the playbook repository or exposed in job output. Which approach meets the requirement?

Accepted Answer

Store the vault password in an Ansible vault credential and attach it to the job template.. Automation controller vault credentials securely store secrets and inject them into jobs without exposing them in the repository or job output. Attaching such a credential to a job template provides the vault password at runtime, enabling decryption of vaulted files while keeping the secret centralized and auditable.

Answer

Configure the job template to prompt for the vault password at launch time.

Answer

Set the vault password as an environment variable named ANSIBLE_VAULT_PASSWORD on the automation controller host.

Answer

Embed the vault password in the playbook as an encrypted variable using ansible-vault encrypt_string.

Question 12

An organization uses automation controller and must ensure that sensitive data such as passwords and API keys are not exposed in job output. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Use automation controller credentials to store secrets instead of plaintext variables.. Using no_log: true on tasks that handle secrets prevents their output from being logged or displayed. Storing secrets in automation controller credentials keeps them out of playbooks and job output. Together, these actions ensure sensitive data is not exposed while maintaining operational visibility.

Answer

Disable job output entirely for all job templates that use secrets.

Answer

Enable verbose logging on the job template to audit variable usage.

Answer

Store all secrets in an unencrypted file on the automation controller and rely on file permissions.

Question 13

A playbook that manages user accounts must run a task that passes a decrypted service account password to a command. Job output currently shows the password in the task result. Which change ensures the password is not displayed while keeping the task functional?

Accepted Answer

Set no_log: true on the task so its output is suppressed in the job log.. Ansible renders task return data in the job output, so any secret passed as an argument or registered value can leak. Applying no_log: true to the specific task suppresses that output while leaving the task's execution intact. This is the targeted control for hiding sensitive values at runtime, complementing vault encryption that only protects data at rest.

Answer

Run the playbook with --diff to show only changes and hide unchanged task output.

Answer

Add the password variable to a vault-encrypted file and reference it with vars_files.

Answer

Set display_skipped_hosts and display_ok_hosts to false in ansible.cfg.

Question 14

A playbook must write a sensitive token to a remote managed node's /etc/app/token.conf file. The security team requires that the token never appear in plaintext in the playbook or in the controller's job output. The token is stored in an Ansible Vault-encrypted variable file. Which task implementation best meets these requirements?

Accepted Answer

Use the copy module with content: "{{ vault_token }}" and set no_log: true on the task.. The copy module with content and no_log: true ensures the decrypted vault variable is written to the remote file while suppressing sensitive task output. Storing the token only in the vault-encrypted file keeps the playbook free of plaintext. The other approaches either embed the secret in a template or allow the expanded token to be logged, violating the security requirements.

Answer

Use the shell module with a command that echoes the token into the file and redirect the output to /dev/null.

Answer

Use the lineinfile module with line: "token={{ vault_token }}" and rely on Vault encryption alone.

Answer

Use the template module with a Jinja2 template that contains the token literal and add no_log: true.

Question 15

A build of an execution environment fails with an error that ansible-builder cannot find the collection acme.internal.utils in any configured Galaxy server. The collection exists on the private Automation Hub, and the build host can reach it. The execution-environment.yml lists the collection under dependencies.galaxy pointing to requirements.yml. What is the most likely cause?

Accepted Answer

The ansible.cfg used by ansible-builder does not define the private Automation Hub as a Galaxy server with valid credentials.. The error indicates the collection cannot be found in any configured Galaxy server. Since the collection exists on the private Automation Hub and the host can reach it, the most likely cause is that the ansible.cfg used by ansible-builder does not define that Hub with valid credentials. Without the server URL and token, the builder cannot authenticate and will not see the collection.

Answer

The collection name in requirements.yml must be prefixed with the Galaxy server name, such as hub_internal.acme.internal.utils.

Answer

The execution environment base image does not include ansible-galaxy, so collection installation is skipped.

Answer

The collection version in requirements.yml is pinned to a version that does not exist on the private Automation Hub.