EX294 Practice Test 2 — 25 Questions

Question 1

A playbook uses 'vars_prompt' to ask for a confirmation before proceeding with destructive changes. However, when the playbook is run from a CI/CD pipeline, it hangs indefinitely. What is the best way to handle this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pass the variable via --extra-vars and modify the prompt to be conditional with 'when: variable is not defined'.. Passing the variable via --extra-vars and making the prompt conditional with 'when: variable is not defined' allows the pipeline to provide the variable non-interactively. Option A is unsafe. Option B's --check mode does not solve prompts. Option C is unrelated. Option D encrypts data but does not handle prompts. Therefore, E is best.

Answer

Remove the prompt and always proceed.

Answer

Set ANSIBLE_STDOUT_CALLBACK=unixy to avoid interactive prompts.

Answer

Encrypt the confirmation in vault and include it.

Answer

Use --check mode to simulate.

Question 2

A company wants to implement a rolling update for a stateful application where hosts cannot be updated in parallel due to data consistency. They also need to ensure that if any host fails, the entire update is rolled back. Which strategy meets these requirements?

Accepted Answer

Use serial: 1 and any_errors_fatal: yes. Setting `serial: 1` ensures hosts are updated one at a time, preventing parallel updates that could break data consistency for a stateful application. Adding `any_errors_fatal: yes` causes the entire playbook run to abort immediately if any host fails, which satisfies the requirement for a full rollback on failure.

Answer

Use serial: 2 and any_errors_fatal: yes

Answer

Use serial: 1 and ignore_errors: yes

Answer

Use serial: 0 and max_fail_percentage: 0

Question 3

An Ansible playbook fails intermittently due to a service not starting in time. The administrator wants to configure a task to retry until the service confirms it is running. Which Ansible feature should be used?

Accepted Answer

Until loop with retries and delay.. (Until loop with retries and delay) is correct. The 'until' loop in Ansible allows a task to be retried until a condition is met, with configurable retries and delay. Option B (failed_when) defines when a task is considered failed but does not provide retry functionality. Option C (block/rescue) is used for error handling but does not retry the original task. Option D (async with poll) is for running tasks asynchronously and polling for completion, but it does not inherently retry on failure.

Answer

Failed_when with conditional retry.

Answer

Block and rescue to catch failure.

Answer

Async with poll interval.

Question 4

An Ansible playbook uses the "community.general" collection to manage firewall rules. The engineer wants to use a lookup plugin to fetch the current IPv4 address of a host to include in a dynamic inventory script. Which TWO of the following options correctly describe the usage of lookup plugins in Ansible?

Accepted Answer

Lookup plugins are executed on the control node and return data to the Ansible controller.. Lookup plugins in Ansible are designed to run on the control node (the machine where Ansible is executed), not on the remote host. They fetch data from external sources (e.g., files, databases, environment variables) and return that data to the Ansible controller for use in playbooks or inventory scripts. This aligns with the requirement to fetch the current IPv4 address of a host for a dynamic inventory script, as the lookup plugin can query local or network sources without needing to execute on the target host.

Answer

Lookup plugins are always executed on the remote host.

Answer

Lookup plugins must be imported using the "lookup" keyword.

Answer

The "file" lookup plugin reads the content of a file from the remote host.

Question 5

Your organization uses Ansible Tower to manage a growing number of Linux servers. Currently, there is a single inventory called 'All Servers' that contains all hosts. A new project requires that certain sensitive variables (e.g., API keys) be stored securely and not exposed in job logs. The security team also wants to limit which users can use these credentials. You have been asked to implement a solution. After evaluating, you plan to create a custom credential type with a 'password' field for the API key and assign it to the job template. However, during a test run, the API key is still visible in the job output. What is the most likely reason?

Accepted Answer

The playbook contains a debug task that prints the API key variable.. Even if a credential is properly defined and assigned, any task in the playbook that explicitly references the variable (such as a debug task) will output its value in the job log. Ansible Tower's credential hiding only prevents the credential from being displayed in the job template's 'extra variables' or credential details; it does not automatically suppress the variable's value if the playbook itself prints it. The playbook author must use the 'no_log: true' directive on tasks that handle sensitive data to prevent exposure.

Answer

The custom credential type was created with an 'input' field instead of a 'password' field.

Answer

The 'no_log' parameter was not set in the Ansible configuration for the module.

Answer

The credential was not assigned to the job template; it was only assigned to the project.

Question 6

You are managing a large infrastructure of 500 Linux servers. The servers are divided into groups: 'web', 'app', and 'db'. Each group has specific configuration requirements. You have developed a set of Ansible roles to manage these configurations. Recently, you noticed that when you run the playbook against all servers, the 'web' role is applied to 'app' servers due to a variable misconfiguration. The playbook uses include_role with a variable that determines which role to apply. The variable is defined in group_vars/all.yml as 'server_role: web'. However, each group should have its own role: 'web' for web servers, 'app' for app servers, 'db' for db servers. The playbook includes the role based on '{{ server_role }}'. What is the best course of action to fix this issue without modifying the playbook structure?

Accepted Answer

Define the server_role variable in group_vars/web.yml, group_vars/app.yml, and group_vars/db.yml with the appropriate values.. Ansible's variable precedence dictates that group_vars/<group_name>.yml files override group_vars/all.yml for hosts in that group. By defining `server_role` per group file (web, app, db), each server gets the correct role without modifying the playbook structure. This leverages Ansible's built-in group variable inheritance to resolve the misconfiguration cleanly.

Answer

Change the variable in group_vars/all.yml to a list and use 'include_role' with loop.

Answer

Add a 'when' condition to the include_role task to check the group name.

Answer

Define the server_role in host_vars for each server.

Question 7

Refer to the exhibit. An Ansible playbook targeting server1 fails with a permissions error when connecting. The administrator notices the SSH private key is being used. Which change will likely fix the issue?

Accepted Answer

Change ansible_user to 'ec2-user'.. The error indicates that the SSH private key being used does not correspond to the user attempting to connect. In many cloud environments like AWS, the default user for Amazon Linux 2 is 'ec2-user', and the SSH private key is tied to that user. Changing `ansible_user` to 'ec2-user' ensures the correct user context for key-based authentication, resolving the permissions error.

Answer

Add `ansible_become: yes` to the playbook.

Answer

Remove ansible_ssh_common_args.

Answer

Set ansible_ssh_private_key_file to a different key.

Question 8

When building an execution environment with ansible-builder, a developer notices that the build process fails with an error about missing dependencies. The developer wants to ensure all required Python packages are installed in the execution environment. Which file should be used to specify additional Python packages?

Accepted Answer

requirements.txt. In Ansible Builder, the `requirements.txt` file is used to specify additional Python packages that should be installed in the execution environment. When building an execution environment, Ansible Builder reads this file and installs the listed packages via pip, ensuring all required Python dependencies are present.

Answer

meta/runtime.yml

Answer

galaxy.yml

Answer

bindep.txt

Question 9

A developer creates a collection and wants to ensure it includes a required Python library for a module. Where should this dependency be declared?

Accepted Answer

In the galaxy.yml file under dependencies.. In Ansible collections, Python library dependencies for modules are declared in the `galaxy.yml` file under the `dependencies` key. This ensures that when the collection is installed via `ansible-galaxy collection install`, the required Python packages are automatically resolved and installed. The `dependencies` field in `galaxy.yml` specifically supports listing Python package requirements using the format `python: package_name`.

Answer

In a requirements.txt file at the collection root.

Answer

In the meta/runtime.yml file.

Answer

In the collection's README.

Question 10

In OpenShift, a deployment must gradually shift traffic to new pods during a rolling update. Which default strategy achieves this?

Accepted Answer

RollingUpdate. The RollingUpdate strategy is the default deployment strategy in OpenShift (and Kubernetes) that gradually replaces old pods with new ones while maintaining application availability. It achieves this by incrementally scaling down the old ReplicaSet and scaling up the new one, controlled by parameters like maxSurge and maxUnavailable, ensuring a smooth transition of traffic to new pods.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Custom strategy

Answer

Recreate

Question 11

Refer to the exhibit. The administrator observes the output and is concerned because the 'Check on async job' task shows 'finished: 0'. What does this indicate?

Accepted Answer

The async job is still running.. In the context of ansible async jobs, 'finished: 0' indicates that the job has not completed yet and is still running. A value of '1' would mean the job finished. Therefore, the administrator's concern that the job shows 'finished: 0' is correct because it means the task is still in progress.

Answer

The async job was not started.

Answer

The async job failed.

Answer

The async job has completed successfully.

Question 12

You are managing a fleet of 200 RHEL 8 servers with Ansible Tower. A playbook uses the 'seboolean' module to enable httpd_can_network_connect for a web application. Recently, the playbook has been failing on 10 servers with the error: 'Failed to set SELinux boolean: Unable to communicate with SELinux policy'. Other servers succeed. The playbook runs as the 'ansible' user with passwordless sudo. The failing servers have identical SELinux configuration (enforcing mode, targeted policy) and the same package versions as working servers. You suspect the issue is related to the 'python3-libselinux' package. Which of the following is the most likely cause and the correct fix?

Accepted Answer

The 'python3-libselinux' package is missing on the failing servers. Install it with 'dnf install python3-libselinux'.. The error 'Failed to set SELinux boolean: Unable to communicate with SELinux policy' indicates that the Python bindings required to interact with the SELinux policy are missing. The 'seboolean' module in Ansible relies on the 'python3-libselinux' package to communicate with the SELinux subsystem. Since the playbook runs as the 'ansible' user with passwordless sudo, and the failing servers have identical SELinux configuration and package versions except for this missing dependency, installing 'python3-libselinux' resolves the issue.

Answer

The 'python2-libselinux' package is required because Ansible uses Python 2. Install it with 'dnf install python2-libselinux'.

Answer

The 'ansible' user lacks sudo access to the 'seboolean' command. Add a sudoers entry to allow it.

Answer

The 'libsemanage' package is missing. Install it with 'dnf install libsemanage'.

Question 13

An admin checks the job details and sees this error from the API. What is the most likely cause?

Accepted Answer

The callback plugin is not installed on the controller node.. The error from the API indicates that the callback plugin is missing on the controller node. In Ansible Automation Platform, callback plugins must be installed on the controller node (or execution node) where `ansible-runner` processes job events. If the plugin is not present there, the API will report a failure when the job attempts to use it, even if the execution environment contains the plugin.

Answer

The job template is using an execution environment that lacks the plugin.

Answer

The callback plugin name is misspelled in the project.

Answer

The machine credential is invalid.

Question 14

The build fails with a DNS resolution error for `registry.redhat.io`. Which troubleshooting step is most likely to resolve the issue?

Accepted Answer

Verify DNS settings in `/etc/resolv.conf` or configure a custom DNS server for the container runtime.. A DNS resolution error for `registry.redhat.io` indicates that the container runtime (e.g., Podman) cannot resolve the registry's hostname to an IP address. This is a network/DNS issue, not an authentication or caching problem. Verifying or correcting DNS settings in `/etc/resolv.conf` or configuring a custom DNS server for the container runtime directly addresses the root cause by ensuring the host or container runtime can resolve the registry's FQDN.

Answer

Run `podman login registry.redhat.io` to authenticate.

Answer

Restart the container runtime service.

Answer

Use the `--no-cache` flag to force a fresh build.

Question 15

An administrator has a playbook with tasks tagged 'install', 'configure', and 'service'. There are no untagged tasks. They want to run only the tasks tagged 'install' and 'configure', skipping 'service'. Which three commands will achieve this? (Choose three.)

Accepted Answer

ansible-playbook site.yml --tags install,configure. Options A, C, and E are correct. Option A uses a comma-separated list with `--tags` to run tasks tagged 'install' or 'configure'. Option C uses `--skip-tags service` to exclude the 'service' tag, running all other tags (install and configure). Option E uses multiple `--tags` options, which Ansible combines with OR logic, effectively running tasks matching either 'install' or 'configure'. Options B and D are incorrect: B runs only 'configure' tasks (since it skips install and service), and D runs only 'install' tasks (since it specifies only that tag and skips service).

Answer

ansible-playbook site.yml --tags configure --skip-tags install,service

Answer

ansible-playbook site.yml --tags install --skip-tags service

Question 16

An Ansible playbook retrieves a JSON response from an API and stores it in the variable `api_response`. The JSON structure is a list of objects, each with keys `name`, `status`, and `id`. The team needs to create a list of names for objects where status is 'active'. Which filter should be used?

Accepted Answer

{{ api_response | selectattr('status', 'equalto', 'active') | map(attribute='name') | list }}. It uses `selectattr` to filter the list of objects to only those where `status` equals 'active', then `map` to extract the `name` attribute from each filtered object, and finally `list` to convert the result into a list. This is the standard Ansible approach for filtering a list of dictionaries and extracting specific keys.

Answer

Answer

Answer

Question 17

An Ansible Tower/AWX administrator wants to prevent users from viewing credential passwords in plain text. Which credential type should be used for SSH passwords?

Accepted Answer

Machine credential. Machine credentials in Ansible Tower/AWX are the correct choice for SSH passwords because they are specifically designed to store SSH authentication parameters, including passwords, private keys, and key passphrases. When a machine credential is configured with an SSH password, Tower/AWX encrypts the password at rest and never exposes it in plain text to users through the web interface or API, ensuring that credential secrets remain hidden.

Answer

SSH credential

Answer

Password credential

Answer

Login credential

Question 18

An Ansible playbook sets 'serial: 20%' for rolling updates, but the inventory contains 5 hosts. How many hosts are updated simultaneously?

Accepted Answer

1. When 'serial: 20%' is set in an Ansible playbook, the percentage is calculated based on the total number of hosts in the inventory. With 5 hosts, 20% of 5 equals 1.0, which is rounded down to 1. Therefore, only 1 host is updated at a time during the rolling update.

Answer

2

Answer

3

Answer

0

Answer

5

Question 19

Drag and drop the steps to configure a container using Podman with a custom Dockerfile in the correct order.

Accepted Answer

Create a Dockerfile, then build the image using podman build, then list images using podman images, then run the container using podman run, then verify the container is running using podman ps.. Podman workflow: create Dockerfile, build image, list images, run container, verify.

Answer

Build the image using podman build, then create a Dockerfile, then run the container using podman run, then list images using podman images, then verify the container is running using podman ps.

Answer

Create a Dockerfile, then list images using podman images, then build the image using podman build, then run the container using podman run, then verify the container is running using podman ps.

Answer

Run the container using podman run, then create a Dockerfile, then build the image using podman build, then list images using podman images, then verify the container is running using podman ps.

Question 20

An admin imports this inventory into AAP and assigns a machine credential that uses SSH key authentication. The job fails with 'Authentication failed'. What is the most likely cause?

Accepted Answer

The machine credential does not contain an SSH private key.. In Red Hat Ansible Automation Platform (AAP), when a machine credential is assigned to a host, that credential's SSH key is used for authentication. If the credential does not contain an SSH private key, authentication will fail. Credentials take precedence over inventory variables such as ansible_ssh_private_key_file, so a conflict is not the likely cause. Therefore, the most likely cause is that the machine credential is missing its SSH private key.

Answer

The private key file path in the inventory does not exist on the controller.

Answer

The credential's SSH key is not being used because the inventory variable ansible_ssh_private_key_file conflicts.

Answer

The 'ansible_become' variable is missing from the inventory.