EX294 Practice Test 25 — 15 Questions

Question 1

You are managing an Ansible Automation Platform deployment that uses automation mesh with one control node and two execution nodes. The control node is in the DMZ, and the execution nodes are in a private network. The organization's security policy requires that all secrets (e.g., SSH keys, API tokens) be encrypted at rest and never transmitted in plaintext. You have configured vault-encrypted credentials and set the vault password as a credential on the control node. However, a recent audit reveals that when a job runs, the vault password is visible in the job output on the execution nodes. The execution nodes are configured to stream job events back to the control node. The automation controller version is 4.3. The following settings are in place: 'no_log' is not set for any variables; the vault password is stored as a 'Vault password' credential type. The job template uses a custom credential type that injects the vault password as an environment variable. The execution nodes have access to the vault password via that environment variable. The audit shows the environment variable is printed in the job output because the playbook uses the 'env' module to display environment variables for debugging. You must prevent the vault password from appearing in any job output without breaking the ability to decrypt vault-encrypted variables. Which action should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Edit the custom credential type's input injection to set 'no_log: true' for the environment variable that carries the vault password.. Setting `no_log: true` on the environment variable injection in the custom credential type prevents Ansible from logging the value of that variable in job output, while still allowing the vault password to be used by the playbook to decrypt vault-encrypted variables. This directly addresses the audit finding without removing debugging capabilities or changing the credential type.

Answer

Remove the 'env' task from the playbook and ensure no other tasks print environment variables.

Answer

Configure the automation controller's 'Settings' to enable 'Display secrets' = false.

Answer

Change the custom credential type to use the built-in 'Vault password' credential type and remove the custom credential type.

Question 2

An administrator runs this playbook against a group of 10 web servers. The update fails on the third host (host3) due to a yum error. What is the most likely outcome?

Accepted Answer

The playbook continues with the remaining hosts because the number of failures (1) is below the 25% threshold.. The playbook uses the `serial: 2` directive, which batches hosts in groups of two, and the `max_fail_percentage: 25` setting. With 10 hosts, 25% allows up to 2 failures (2.5 rounded down). Since only one failure occurred (on host3), the playbook continues processing the remaining batches after the failed batch completes.

Answer

Only the first batch (host1 and host2) are updated successfully; the remaining hosts are skipped.

Answer

All hosts are disabled in HAProxy and the playbook fails.

Answer

The playbook halts immediately after the failure on host3.

Question 3

An Ansible playbook needs to generate a list of IP addresses from a range 192.168.1.10 to 192.168.1.20. Which filter should be used in a Jinja2 template?

Accepted Answer

{{ '192.168.1.10-20' | ipaddr('range_include') }}. The `ipaddr` filter with the `'range_include'` parameter generates a list of all IP addresses within a specified range, including both endpoints. In this case, `'192.168.1.10-20' | ipaddr('range_include')` produces a list from 192.168.1.10 through 192.168.1.20, which is exactly what the playbook needs to generate.

Answer

Answer

Answer

Question 4

Which THREE features are provided by Ansible's filter plugins? (Select exactly three.)

Accepted Answer

Data transformation (e.g., format dates, modify strings). Filter plugins in Ansible are used to transform data within Jinja2 templates. Option B is correct because filters like `| date`, `| regex_replace`, and `| upper` directly perform data transformation tasks such as formatting dates and modifying strings, which is a core purpose of filter plugins.

Answer

Defining new Ansible modules

Answer

Fetching data from external APIs

Question 5

An administrator is migrating playbooks to use execution environments in automation controller. They want to ensure that all playbook runs use a custom execution environment that includes the necessary Python libraries and is signed to comply with security policy. What should the administrator do?

Accepted Answer

Build the execution environment using ansible-builder and then push it to a private registry and reference it in the automation controller.. The administrator must build a custom execution environment using `ansible-builder`, which packages the required Python libraries and Ansible content into a container image. This image must then be pushed to a private registry (e.g., Quay.io or Red Hat Registry) and referenced in automation controller's execution environment configuration. Additionally, signing the image (e.g., via Podman or Skopeo) ensures compliance with security policies by verifying image integrity before execution.

Answer

Push the custom execution environment to the default namespace and assign it to job templates.

Answer

Use the default execution environment and install Python libraries via the playbook.

Answer

Define the execution environment in the project repository and use a pre-run hook.

Question 6

A custom filter plugin named `custom_filter` is stored in `./filter_plugins/` relative to the playbook. The playbook runs on a control node where the `ansible.cfg` sets `filter_plugins = /opt/ansible/filters`. Which location will Ansible search for the plugin first?

Accepted Answer

/opt/ansible/filters. Ansible's plugin loading order prioritizes the `filter_plugins` directory specified in `ansible.cfg` over the `./filter_plugins/` directory relative to the playbook. The `ansible.cfg` setting explicitly overrides the default search path, so `/opt/ansible/filters` is checked first.

Answer

Both A and B, with A first then B

Answer

./filter_plugins/

Answer

~/.ansible/plugins/filter

Question 7

An Ansible inventory file includes a group [webservers] containing web1. Another group [all] contains web1 and web2. When running a playbook with --limit webservers, the playbook fails on web2. Why does this happen?

Accepted Answer

The 'webservers' group includes web2 due to a misconfiguration.. The inventory file does not list web2 under the 'webservers' group; only web1 is listed. However, when running the playbook with --limit webservers, web2 is still targeted. This indicates a misconfiguration, such as a duplicate host entry, incorrect group assignment, or a faulty inventory script that inadvertently includes web2 in the webservers group. Ansible's --limit option restricts execution to hosts that are members of the specified group, so if web2 is not supposed to be in webservers but appears due to error, the playbook fails on web2 because it is unreachable or misconfigured for that role.

Answer

The SSH key for web2 is not authorized.

Answer

The inventory file has a syntax error causing web2 to be included in webservers.

Answer

The playbook's 'hosts' directive is set to 'all' instead of 'webservers'.

Question 8

Refer to the exhibit. An administrator deployed this configuration using the controller_configuration role. After deployment, user jdoe can administer Engineering organization but cannot launch a job template within it. What is the most likely reason?

Accepted Answer

The user needs to be added to the job template's role specifically. In Ansible Tower/AWX, organization-level admin roles grant administrative privileges over the organization's objects (e.g., users, teams, inventories) but do not automatically confer execute permissions on specific job templates. To launch a job template, a user must have the 'execute' role on that job template itself, either directly or via a team or user role assignment. Since user jdoe can administer the Engineering organization but cannot launch a job template, the missing piece is the explicit job template role assignment.

Answer

The admin role for organization does not include job template launch permissions

Answer

The user's password is vault-encrypted and cannot be decrypted

Answer

The role assignment should be at the team level, not user level

Question 9

When using the 'uri' module to interact with a REST API in Ansible, which TWO of the following statements about error handling and response parsing are correct?

Accepted Answer

To access the response body, use the 'body' key of the registered variable and then parse it with a filter like 'json_query'.. When you register the result of an `uri` module call, the response body is stored under the `body` key of the registered variable. To extract or filter data from that JSON body, you can use the `json_query` filter (which relies on jmespath) to parse and query the JSON structure. This is the standard approach for accessing and manipulating API response data in Ansible.

Answer

The 'follow_redirects' parameter must be set to 'all' to handle HTTP 4xx and 5xx errors gracefully.

Answer

The 'failed_when' condition can inspect the HTTP response before the request is sent.

Answer

The 'register' keyword automatically parses JSON responses into Ansible variables.

Question 10

Which three of the following are valid methods to pass variables to an Ansible playbook at runtime? (Choose three.)

Accepted Answer

Using '--extra-vars' command line option.. The `--extra-vars` (or `-e`) command-line option allows you to pass variables directly to an Ansible playbook at runtime. This overrides any previously defined variables and can accept key=value pairs or load from JSON/YAML files, making it the primary method for runtime variable injection.

Answer

Using '--ask-vault-pass' and storing variables in encrypted files.

Answer

Using 'environment' directive in the playbook.

Question 11

A system administrator maintains a dynamic inventory script that queries a cloud provider API to build host lists. The script returns valid JSON, but after importing into Ansible Tower, the inventory shows zero hosts. The script is executable and placed in the expected project directory. What is the most likely cause?

Accepted Answer

The script has not been added as an inventory script in Ansible Tower's inventory scripts settings.. Ansible Tower requires that a dynamic inventory script be explicitly registered as an inventory script in the Tower UI under 'Inventories' → 'Scripts'. Even if the script is executable and returns valid JSON, Tower will not execute it unless it is configured as a custom inventory script source. The script must be added via the 'Add' button in the Inventory Scripts section, where Tower will then use it to populate the inventory.

Answer

The script does not output JSON in the correct format expected by Ansible Tower.

Answer

The script does not have the executable permission set.

Answer

The script is written in a language that Ansible Tower does not support.

Question 12

A system administrator wants to run a playbook on all hosts in the 'webservers' group, but only if the host is currently online. Which approach should be used?

Accepted Answer

Use 'wait_for_connection' as a pre-task to ensure connectivity.. The `wait_for_connection` module is specifically designed to pause the playbook execution until a remote host becomes reachable over SSH or WinRM. By placing it as a pre-task, the playbook will only proceed to subsequent tasks for hosts that are currently online, effectively filtering out offline hosts. This directly meets the requirement to run the playbook only on hosts in the 'webservers' group that are online.

Answer

Set 'gather_facts: no' to skip fact collection.

Answer

Use 'throttle: 1' to limit concurrent connections.

Answer

Set 'serial: 1' to run on one host at a time.

Question 13

An enterprise is running Ansible Automation Platform with automation mesh across three data centers. Each data center has a control node and multiple execution nodes. The mesh topology is set up with `node_type: control` for control nodes and `node_type: execution` for execution nodes. The nodes in DC2 can reach nodes in DC1 and DC3, but DC1 and DC3 cannot directly reach each other. The admin notices that jobs that require execution on DC3 are being scheduled on DC1 or DC2, causing slow performance. The admin checks the mesh node list and sees all nodes are healthy. What should the admin do to ensure jobs are executed geographically closest to the target nodes?

Accepted Answer

Configure `node_policy` to set `topology=dc3` on execution nodes in DC3 so the controller can route jobs based on proximity.. `node_policy` with `topology` allows administrators to define geographic or logical proximity hints for execution nodes. By setting `topology=dc3` on DC3 nodes, the automation controller can intelligently route jobs to the nearest available execution node, reducing latency without requiring direct network connectivity between DC1 and DC3.

Answer

Establish a direct VPN link between DC1 and DC3 to reduce latency.

Answer

Change the `node_type` of DC3 execution nodes to `control` to make them preferred.

Answer

Create host labels to tag nodes by data center and assign job templates accordingly.

Question 14

Which two statements are true regarding Ansible roles? (Choose two.)

Accepted Answer

A role can have a meta/main.yml file to define dependencies.. The meta/main.yml file within a role is specifically designed to declare role dependencies. When Ansible encounters this file, it automatically resolves and executes the listed dependent roles before the current role, ensuring required tasks, variables, or handlers are available. This is a core feature for modularizing and reusing automation logic across playbooks.

Answer

Role handlers are shared across all roles in the play.

Answer

Role variables in vars/main.yml can be overridden by playbook vars.

Answer

Roles can only be used in a playbook's roles section.

Question 15

An Ansible role is designed to work on both RHEL 7 and RHEL 8 systems. The role uses the 'redhat_subscription' module. However, on RHEL 8, the module requires a different parameter name. The developer wants to use a conditional parameter based on the OS version. Which filter allows checking the operating system version from 'ansible_facts'?

Accepted Answer

version. 'version', because the `version` filter in Ansible is specifically designed to compare version strings from `ansible_facts` (e.g., `ansible_facts['ansible_distribution_version']`). It allows conditional logic based on OS version, such as checking if the version is '8.0' or higher, which is exactly what the developer needs to handle the different parameter names for the `redhat_subscription` module between RHEL 7 and RHEL 8.

Answer

int

Answer

sys.version

Answer

bool