EX294 Practice Test 2 — 25 Questions

Question 1

An administrator needs to execute a role named `common` on all hosts in the play, but only for hosts that are members of the `webservers` group. Which playbook construct achieves this?

Accepted Answer

Apply the role under a play with hosts: webservers.. The most direct way to run a role only on a specific group is to target that group in the play's hosts directive. Roles run on all hosts in the play, so restricting the play's hosts restricts the role. Other options either do not filter hosts or misuse Ansible features.

Answer

Add a task with delegate_to: webservers before including the role.

Answer

Set a variable in group_vars/webservers.yml and use it in the role's tasks.

Answer

Use the roles keyword with a when condition on the group name.

Question 2

A company manages its infrastructure using Ansible Tower. There are two teams: Team Alpha manages web servers in the 'webservers' group, and Team Beta manages database servers in the 'dbservers' group. Both teams need to use the same SSH credential to connect to their respective servers. The credential is stored in Tower as 'shared_ssh_key'. Team Alpha reports that they can launch jobs against the 'webservers' group, but Team Beta gets an error when trying to launch jobs against the 'dbservers' group: 'You do not have permission to use this credential.' Both teams are members of the same organization. The inventory is a single inventory source with separate groups. The credential has been assigned to the organization. What is the most likely cause of Team Beta's issue, and what is the correct solution?

Accepted Answer

Grant Team Beta the 'Use' role on the credential 'shared_ssh_key'.. In Ansible Tower, credentials are assigned to an organization, but users or teams must be explicitly granted the 'Use' role on a credential to be able to use it in a job template. Team Alpha can use the credential because they likely have the 'Use' role, while Team Beta does not. Granting Team Beta the 'Use' role on 'shared_ssh_key' resolves the permission error.

Answer

Create a new credential with the same SSH key and assign it to Team Beta.

Answer

Assign the credential to the dbservers group in the inventory.

Answer

Move the credential from the organization to the project level.

Question 3

Consider the task: `- debug: msg={{ item | upper }}` with `loop: "{{ ['a','b'] }}"`. What will be the output?

Accepted Answer

Two debug messages: 'A' and 'B'. The `upper` filter in Ansible converts each string item in the loop to uppercase. The `loop` directive iterates over the list `['a','b']`, and for each iteration, the `{{ item | upper }}` expression applies the `upper` filter to the current item, resulting in `'A'` and `'B'`. The `debug` module then prints each transformed value as a separate message.

Answer

An error because upper expects a string, not a loop variable.

Answer

Two debug messages: 'a' and 'b'

Answer

One debug message with the list ['A','B']

Question 4

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 5

An administrator wants to reuse a set of tasks across multiple playbooks. Which Ansible approach is most appropriate?

Accepted Answer

Creating a role with tasks in tasks/main.yml.. Roles are the standard Ansible mechanism for packaging and reusing tasks, variables, handlers, and other automation content across multiple playbooks. By placing tasks in a role's `tasks/main.yml`, the administrator can reference that role in any playbook using the `roles:` directive, enabling clean, modular reuse without duplication.

Answer

Encrypting the tasks with Ansible Vault.

Answer

Using ansible-doc to document the tasks.

Answer

Writing a custom module in Python.

Question 6

A collection version is already published on Automation Hub. The developer needs to update the collection with a new feature. What must be done to the version number before publishing again?

Accepted Answer

Increment the patch or minor version number.. Automation Hub enforces immutable collection versions; once a version is published, it cannot be overwritten or deleted. To publish a new feature, you must increment the patch (e.g., 1.0.0 → 1.0.1) or minor (e.g., 1.0.0 → 1.1.0) version number in the galaxy.yml file, following semantic versioning (semver) as required by Ansible collections.

Answer

No change needed; Automation Hub overwrites.

Answer

Increment the major version number.

Answer

Change the version to a pre-release identifier.

Question 7

An organization uses a private automation hub to distribute collections. A developer has created a new collection and needs to ensure it is available in the hub for others. Which command should the developer use to upload the collection to the private automation hub?

Accepted Answer

ansible-galaxy collection publish. `ansible-galaxy collection publish` is the command specifically designed to upload a built collection artifact (a .tar.gz file) to a Galaxy server, including a private automation hub. This command sends the collection to the configured Galaxy server endpoint, making it available for others to install via `ansible-galaxy collection install`.

Answer

ansible-galaxy collection import

Answer

ansible-galaxy collection build

Answer

ansible-galaxy collection install

Question 8

What is the purpose of the 'vars' keyword under the httpd role inclusion?

Accepted Answer

Override default variables for that role. The 'vars' keyword under a role inclusion in Ansible allows you to override the default variables defined within that specific role. This is done at the point of inclusion, providing role-specific variable overrides without affecting other roles or the playbook's global variable scope.

Answer

Set variables for the common role

Answer

Define new variables for the playbook

Answer

Set variables for all roles in the play

Question 9

A developer wants to reuse a set of tasks that conditionally include other task files based on variables defined per host. Which method should be used to ensure the included tasks are evaluated per host at runtime?

Accepted Answer

include_tasks. Include_tasks, because it dynamically loads and evaluates task files at runtime, allowing conditional logic and per-host variables to be resolved when the tasks are executed. This is essential for reusing a set of tasks that conditionally include other task files based on variables defined per host, as include_tasks processes the included file fresh each time it is encountered, respecting any host-specific variable context.

Answer

include_role

Answer

import_role

Answer

import_tasks

Question 10

Refer to the exhibit. An administrator runs the playbook but the wait_for task fails. What is the most likely cause?

Accepted Answer

The ansible_facts variable may not be available because fact gathering is disabled.. The playbook uses `ansible_facts['ansible_tcpip_socket']['port']` to supply the port number to the `wait_for` module. If fact gathering is disabled (e.g., via `gather_facts: no` at the play level or `ANSIBLE_GATHERING=explicit`), the `ansible_facts` dictionary is empty, so the variable resolves to `None` or an undefined value, causing the task to fail. The error is not a syntax or type issue but a missing fact dependency.

Answer

The http_port variable is misspelled.

Answer

The wait_for module requires the 'port' parameter to be an integer.

Answer

The delegate_to should be set to the remote host.

Question 11

An administrator needs to provide a set of credentials to a job template that requires a machine credential for SSH and a source control credential for the project. What is the correct way to associate these credentials?

Accepted Answer

Assign both a machine credential and a source control credential to the job template. Ansible Tower/AWX allows multiple credentials of different types to be assigned to a single job template. A machine credential handles SSH authentication for target hosts, while a source control credential manages authentication for the project repository (e.g., Git). This separation follows Ansible's modular credential design, where each credential type serves a distinct purpose and can be independently managed.

Answer

Define the source control token in the playbook using the 'set_fact' module

Answer

Create a single credential that includes both SSH key and source control token

Answer

Store the source control token as an extra variable in the job template

Question 12

Which two actions are appropriate when configuring a custom execution environment for an automation controller job? (Choose two.)

Accepted Answer

Building the execution environment using ansible-builder. Option B is correct because ansible-builder is the supported tool for creating custom execution environments; it reads an execution-environment.yml definition file and produces a container image containing the required collections, Python packages, and system dependencies. Option E is correct because the execution environment image is defined by a Containerfile (or Dockerfile) that specifies the base image and installs the needed packages, which ansible-builder uses as its build input. Option A is incorrect because execution environments can be stored in private registries (e.g., automation hub, private container registries), not only public ones, and public-only storage is not a requirement. Option C is incorrect because execution_environment_image is configured on the job template or organization in the automation controller, not in the project's SCM repository. Option D is incorrect because using the default execution environment does not constitute configuring a custom execution environment, which is what the scenario requires.

Answer

Storing the execution environment in a public registry only

Answer

Setting the execution_environment_image in the project's SCM

Answer

Using the default execution environment provided by controller

Question 13

Drag and drop the steps to configure a basic NFS server to export a directory in the correct order.

Accepted Answer

Install NFS packages, create directory, configure /etc/exports, start NFS service, verify export. To configure a basic NFS server to export a directory, the correct sequence is: install the NFS packages (e.g., nfs-utils), create the directory to be shared, edit /etc/exports to define the export, start and enable the NFS server service, and finally verify the export using 'showmount -e localhost'. This workflow ensures that all prerequisites are met before each step, avoiding errors such as missing directories or unapplied configuration.

Answer

Install NFS packages, create directory, start NFS service, configure /etc/exports, verify export

Answer

Create directory, install NFS packages, configure /etc/exports, start NFS service, verify export

Answer

Install NFS packages, configure /etc/exports, create directory, start NFS service, verify export

Question 14

A playbook has a dictionary `config` that maps service names to ports. The team wants to iterate over both keys and values in a task. Which filter should be used to convert the dictionary into a list of key-value pairs?

Accepted Answer

dict2items. The `dict2items` filter is the correct choice because it converts a dictionary into a list of key-value pairs, each represented as a dictionary with `key` and `value` keys. This is the standard Ansible filter for iterating over both keys and values in a `loop` within a task, enabling access to `item.key` and `item.value`.

Answer

items2dict

Answer

flatten

Answer

json_query

Question 15

Match each storage concept to its description.

Accepted Answer

LVM: Allows flexible disk management with volume groups and logical volumes. The correct matches are: LVM for flexible disk management with VGs and LVs, RAID for combining disks for redundancy/performance, Stratis for pool-based snapshots and thin provisioning, and VDO for block-level deduplication/compression. Common confusions include swapping LVM with VDO and RAID with Stratis.

Answer

LVM: Deduplicates and compresses data at the block level

Answer

RAID: Provides thin provisioning and snapshots using a pool-based model

Question 16

An Ansible rolling update playbook has 'serial: 1' and 'max_fail_percentage: 0'. During the update of a 5-host group, the first host fails. What is the outcome?

Accepted Answer

The play aborts immediately. With 'serial: 1', Ansible updates one host at a time. 'max_fail_percentage: 0' means that if any host fails (0% failure tolerance), the entire playbook run is aborted immediately. When the first host fails, Ansible stops further execution because the failure percentage exceeds the threshold, and no retries or continuation occur.

Answer

The play pauses for manual intervention

Answer

The play retries the failed host

Answer

The play continues with the remaining 4 hosts

Answer

The play marks the host as unreachable and continues

Question 17

A team uses Ansible to update a web application across 10 servers with minimal downtime. Which playbook directive achieves one-at-a-time updates?

Accepted Answer

serial: 1. C is correct because the `serial: 1` directive in an Ansible playbook controls the number of hosts that are updated simultaneously. Setting `serial: 1` forces Ansible to execute the playbook on one host at a time, ensuring that the web application is updated sequentially across the 10 servers, which minimizes downtime by keeping the other 9 servers available during each individual update.

Answer

run_once: true

Answer

delegate_to: localhost

Answer

throttle: 1

Answer

forks: 10

Question 18

An organization wants to deploy Ansible Automation Platform 2.x in a highly available configuration. Which component must be deployed in an active-active cluster to ensure controller failover?

Accepted Answer

Automation controller. The automation controller is the component that provides the web UI, REST API, and job execution management in Ansible Automation Platform 2.x. For high availability, multiple controller nodes must be deployed in an active-active cluster behind a load balancer, ensuring that if one controller fails, another can immediately take over without service interruption.

Answer

PostgreSQL database

Answer

Private Automation Hub

Answer

Automation mesh

Question 19

Which TWO statements are true regarding the deployment of Ansible Automation Platform in a highly available configuration?

Accepted Answer

The automation controller requires a PostgreSQL database that must be configured with replication for high availability.. Option C is correct because in a highly available Ansible Automation Platform deployment, the automation controller (the control plane) relies on an external PostgreSQL database, and HA is achieved by configuring that PostgreSQL instance with replication (e.g., streaming replication or a supported HA topology) so the controller can fail over without losing job data. Option E is correct because the automation mesh (based on receptor) is the component that provides resilient, fault-tolerant execution by routing jobs across hop nodes and execution nodes, allowing execution to continue even if individual nodes become unavailable. Option A is incorrect because automation hub's PostgreSQL database is not strictly required to be external for HA in the way described; hub can be deployed with its own supported database configuration, and the statement overstates the requirement. Option B is incorrect because execution nodes do not need direct network access to the automation controller's database; they communicate with the controller through the mesh/receptor network, not by connecting to PostgreSQL directly. Option D is incorrect because SQLite is not supported for production automation controller deployments; PostgreSQL is required.

Answer

The automation hub requires an external PostgreSQL database to store collections and execution environments.

Answer

Execution nodes must have direct network access to the automation controller database.

Answer

The automation controller can use an embedded SQLite database for production deployments.

Question 20

An Ansible administrator wants to use an encrypted vault file to store sensitive variables. Which command creates a new vault file and prompts for a password?

Accepted Answer

ansible-vault create secrets.yml. `ansible-vault create secrets.yml` creates a new encrypted vault file and immediately prompts the user to set a password, which is then used to encrypt the file. This command is specifically designed for initial creation of vault files, unlike `edit` which requires an existing file, `view` which only displays content, or `encrypt` which encrypts an existing plaintext file.

Answer

ansible-vault edit secrets.yml

Answer

ansible-vault view secrets.yml

Answer

ansible-vault encrypt secrets.yml