EX294 Practice Test 25 — 15 Questions

Question 1

A playbook uses the `ansible.builtin.uri` module to interact with a REST API. The API requires a Bearer token that is stored in an encrypted variable file. The playbook must ensure the token is not exposed in logs. Which approach best meets the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set `no_log: true` on the task that uses the `uri` module.. To prevent a sensitive token from appearing in logs, the task that uses the token must have no_log set to true. This suppresses all output from that task, including module arguments and results. While vault encrypts the token at rest, it does not prevent logging during execution. Therefore, no_log is the necessary control in this scenario.

Answer

Set `ANSIBLE_DEBUG` to false in the environment.

Answer

Encrypt the variable file with `ansible-vault` and reference it in the playbook.

Answer

Use `vars_prompt` to ask for the token at runtime.

Question 2

An automation team must ensure that sensitive variables used in playbooks are protected both at rest and during job execution in Ansible Automation Platform. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Mark tasks that use sensitive variables with no_log: true to prevent values from appearing in job output.. Encrypting sensitive variables with Ansible Vault and supplying the vault password via a controller credential protects data at rest, while no_log: true prevents runtime exposure in job output. Plaintext group_vars, verbose logging, and repository-stored vault passwords all undermine security and fail to meet the dual protection requirement.

Answer

Store the vault password in the project repository as a plaintext file for easy access.

Answer

Define sensitive variables in group_vars/all in plaintext so they are available to all hosts.

Answer

Enable verbose logging with -vvv to capture all variable values for auditing.

Question 3

An automation controller administrator must ensure that a job template handling credentials follows security best practices for both storage and execution. Which TWO actions should be taken in automation controller? (Choose two.)

Accepted Answer

Reference the credential from the job template so it is injected at runtime instead of hardcoding it in the playbook.. Automation controller stores credentials encrypted and injects them at run time, so keeping SSH keys in a machine credential and referencing that credential from the job template removes secrets from source control and from static inventories. Together these actions centralize secret storage and limit exposure to the moment of execution, which is the intended best practice.

Answer

Enable the job template option to suppress Ansible output so sensitive data is not written to job logs.

Answer

Grant the operator system administrator role on the organization so they can manage all credentials centrally.

Answer

Mark the job template as prompting for the credential on launch so operators supply secrets interactively.

Question 4

You are using Ansible Automation Platform to manage a large number of servers. You need to ensure that playbooks that run against production servers use a separate set of credentials than those used for development servers. The production credentials must be stored securely and audited. Which Ansible Automation Platform feature should you use to achieve this?

Accepted Answer

Create separate credentials in automation controller and assign them to different job templates based on the environment.. Automation controller credentials are designed for secure storage and auditing. By creating separate credentials for production and development and assigning them to the appropriate job templates, you ensure that each environment uses its own set of secrets. The controller encrypts credentials and logs their usage, providing the required audit trail. The other options either store credentials insecurely or lack centralized management and auditing.

Answer

Use the `--ask-pass` and `--ask-become-pass` options when launching playbooks from the command line.

Answer

Use Ansible Vault to encrypt the production credentials and store them in the playbook repository.

Answer

Configure the production inventory with a separate `ansible_user` and `ansible_ssh_pass` in the inventory file.

Question 5

A playbook uses the `copy` module to distribute a configuration file to managed nodes. The file contains a sensitive API key. You want to ensure the API key is not visible in the playbook source or in Ansible logs. Which approach should you use?

Accepted Answer

Store the API key in a vault-encrypted variable file, reference it in the copy module's content parameter, and set no_log: true on the task.. To protect a sensitive API key, it should be stored encrypted using Ansible Vault and referenced in the playbook without exposing plaintext. Marking the task with no_log: true prevents the secret from appearing in output or logs. Using plaintext variables, hardcoded values, or environment variables without no_log leaves the secret exposed in the playbook source or execution logs, failing the security requirement.

Answer

Store the API key in an environment variable on the control node and use the `lookup` plugin `env` to inject it into the copy module.

Answer

Use the `copy` module with the API key hardcoded in the content parameter and rely on Ansible's automatic log redaction.

Answer

Use the `template` module with a Jinja2 template that includes the API key as a plaintext variable defined in the playbook.

Question 6

You are reviewing an Ansible playbook that uses the `ansible.builtin.shell` module to run a command that includes a sensitive API key as an argument. You want to prevent the API key from being displayed in the job output. Which task-level directive should you add?

Accepted Answer

no_log: true. The `no_log: true` directive on a task suppresses all logging for that task, including the command line and its output. This prevents the sensitive API key from appearing in job output. The other directives control privilege escalation, error handling, or change reporting, none of which affect logging of task details. Therefore, `no_log` is the correct choice.

Answer

changed_when: false

Answer

ignore_errors: true

Answer

become: true

Question 7

You are designing a rolling update for a stateful service where each node must be removed from a load balancer, updated, and re-added before the next node is touched. The update must never take more than one node offline at a time, and if the update fails on a node, the play must stop and leave the remaining nodes untouched. Which playbook configuration achieves this?

Accepted Answer

serial: 1 with any_errors_fatal: true and tasks ordered to drain, update, and re-add within the same play.. Ensuring only one node is offline at a time and halting on failure requires a batch size of one and play-level fatal error handling. serial: 1 isolates each node, while any_errors_fatal: true stops the play immediately on any failure, leaving the remaining nodes untouched and still in rotation.

Answer

serial: 1 with ignore_errors: true on the update task so the play can continue to the next node.

Answer

serial: 2 with max_fail_percentage: 50 so that one failure in a batch is tolerated and the play continues.

Answer

serial: 1 with run_once: true on the drain and re-add tasks so they execute only once per batch.

Question 8

An automation team uses Ansible Automation Platform to manage a large number of servers. They need to ensure that sensitive data such as passwords and API keys are not stored in plain text in playbooks or inventory files. They decide to use Ansible Vault to encrypt these secrets. Which of the following best describes how Ansible Vault integrates with playbook execution to protect secrets at runtime?

Accepted Answer

Ansible Vault decrypts secrets on the control node at runtime and passes the decrypted values to managed nodes as needed.. Ansible Vault decrypts encrypted files on the control node when the playbook runs, using the vault password supplied via command line or configuration. The decrypted variables are then used in playbook execution and can be passed to managed nodes as needed. This keeps secrets encrypted at rest in source control while enabling their use in automation. The other options incorrectly place decryption on managed nodes or describe non-existent keyring features.

Answer

Ansible Vault stores secrets in an encrypted keyring on the control node and retrieves them only when explicitly requested by a task.

Answer

Ansible Vault decrypts secrets on the managed node and stores them in memory only during task execution.

Answer

Ansible Vault encrypts secrets on the control node and decrypts them on the managed node using a shared vault password.

Question 9

An organization uses Ansible Automation Platform to manage a large infrastructure. They need to implement security best practices for managing secrets and credentials. Which TWO of the following actions should they take to enhance security? (Choose two.)

Accepted Answer

Use Ansible Vault to encrypt sensitive variables and files before committing them to source control.. Using Ansible Vault to encrypt sensitive data before committing to source control and integrating automation controller with external secret management systems are two key best practices. They ensure secrets are encrypted at rest and managed centrally with access controls. Storing secrets in plain text, disabling all logging, or sharing vault passwords insecurely are harmful practices that would weaken security. These two actions align with the principle of least privilege and defense in depth.

Answer

Disable logging for all playbook runs to prevent any possibility of secrets being logged.

Answer

Store all secrets in plain text in the Git repository to simplify version control.

Answer

Share the vault password among all team members via email to ensure everyone can run playbooks.

Question 10

When building an execution environment with ansible-builder, a developer notices that the build process fails with an error about missing dependencies. The developer wants to ensure all required Python packages are installed in the execution environment. Which file should be used to specify additional Python packages?

Accepted Answer

requirements.txt. In Ansible Builder, the `requirements.txt` file is used to specify additional Python packages that should be installed in the execution environment. When building an execution environment, Ansible Builder reads this file and installs the listed packages via pip, ensuring all required Python dependencies are present.

Answer

meta/runtime.yml

Answer

galaxy.yml

Answer

bindep.txt

Question 11

The build fails with a DNS resolution error for `registry.redhat.io`. Which troubleshooting step is most likely to resolve the issue?

Accepted Answer

Verify DNS settings in `/etc/resolv.conf` or configure a custom DNS server for the container runtime.. A DNS resolution error for `registry.redhat.io` indicates that the container runtime (e.g., Podman) cannot resolve the registry's hostname to an IP address. This is a network/DNS issue, not an authentication or caching problem. Verifying or correcting DNS settings in `/etc/resolv.conf` or configuring a custom DNS server for the container runtime directly addresses the root cause by ensuring the host or container runtime can resolve the registry's FQDN.

Answer

Run `podman login registry.redhat.io` to authenticate.

Answer

Restart the container runtime service.

Answer

Use the `--no-cache` flag to force a fresh build.

Question 12

Refer to the exhibit. The playbook fails because the httpd package is not found. Which is the most likely cause?

Accepted Answer

The target host does not have the necessary repositories enabled.. The error indicates the package is not available. This is typically due to missing or incorrect repository configuration. The playbook itself and role syntax are valid.

Answer

The inventory does not define 'webservers' group.

Answer

The role path is incorrectly configured in ansible.cfg.

Answer

The 'yum' module should use 'name=httpd' instead of YAML syntax.

Question 13

Refer to the exhibit. A user attempts to download the collection using the download URL but the signature verification fails. What is the most likely reason?

Accepted Answer

The user's client does not have the corresponding public key.. B is correct because signature verification of a downloaded collection requires the client to have the corresponding public key that was used to sign the collection. If the user's client lacks this public key, the verification process will fail, even if the collection itself is properly signed and the URL is valid.

Answer

The collection version does not match.

Answer

The collection is not properly signed.

Answer

The download URL is invalid.

Question 14

Which two statements are true regarding Ansible roles? (Choose two.)

Accepted Answer

A role can have a meta/main.yml file to define dependencies.. Option B is correct because a role's meta/main.yml file is exactly where role dependencies are declared under the dependencies key, allowing Ansible to automatically pull in and run other roles before the current one. Option D is correct because variables defined in defaults/main.yml have the lowest precedence in Ansible's variable hierarchy, meaning almost any other variable source (inventory, play vars, role vars, extra vars, etc.) will override them. Option A is wrong because handlers are scoped to the role or play that defines them, not shared globally across all roles. Option C is wrong because vars/main.yml role variables have higher precedence than playbook vars, so playbook vars cannot override them. Option E is wrong because roles can also be included dynamically with include_role or imported with import_role, not only via the roles section.

Answer

Role handlers are shared across all roles in the play.

Answer

Role variables in vars/main.yml can be overridden by playbook vars.

Answer

Roles can only be used in a playbook's roles section.

Question 15

Which TWO statements about Ansible role defaults are true?

Accepted Answer

Defaults are loaded from the defaults/main.yml file.. Option B is correct because Ansible automatically loads role default variables from the defaults/main.yml file inside the role's directory structure, making it the standard location for defining fallback values. Option E is correct because defaults have the lowest precedence in Ansible's variable priority hierarchy, meaning nearly any other variable source (inventory vars, play vars, host vars, extra vars, etc.) will override them. Option A is incorrect because defaults are always loaded, not conditionally based on whether other vars exist; they simply get overridden when higher-priority variables are present. Option C is incorrect because defaults have lower priority than playbook vars, not higher. Option D is incorrect because defaults are specifically designed to be easily overridden by higher-precedence variable sources.

Answer

Defaults are only loaded if no vars are defined.

Answer

Defaults have higher priority than variables defined in the playbook.

Answer

Defaults cannot be overridden.