EX294 Practice Test 2 — 25 Questions

Question 1

A company uses Ansible Tower and has defined a custom inventory script. The inventory returns JSON with nested groups. The playbook needs to list all hosts from a specific group 'webservers' that are not in the 'drain' subgroup. Which combination of filters correctly extracts these hosts?

Accepted Answer

{{ groups['webservers'] | difference(groups['drain']) }}. Option D is correct because the `difference` filter in Ansible returns the elements of the first list that are not present in the second list. This directly matches the requirement: all hosts in the 'webservers' group that are not in the 'drain' subgroup.

Answer

{{ groups['webservers'] | symmetric_difference(groups['drain']) }}

Answer

Answer

Question 2

Given `{{ ['1', '2', '3'] | map('int') | list }}`, what is the result?

Accepted Answer

`[1, 2, 3]`. The `map('int')` filter in Ansible/Jinja2 converts each string element in the list to an integer. The `list` filter then materializes the generator into a list, resulting in `[1, 2, 3]`. Option B is correct because this is the standard behavior of the `map` filter with the `int` function.

Answer

An error because 'int' is not a valid filter name.

Answer

`['1', '2', '3']` as integers, but stored as strings.

Answer

`['1', '2', '3']`

Question 3

An Ansible role uses a variable "server_list" which is a list of dictionaries. Each dictionary has a key "ports" which should be a list of integers. However, due to inconsistent input, "ports" could be a comma-separated string (e.g., "80,443") or already a list of integers (e.g., [80,443]). The engineer wants to normalize "ports" to always be a list of integers for further processing. Which of the following tasks correctly normalizes the "ports" field?

Accepted Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': (item.ports is string) | ternary(item.ports | split(','), item.ports)}) }}"
  loop: "{{ server_list }}". Option D is correct because it uses the `ternary` filter to check if `item.ports` is a string; if true, it splits the string by commas into a list, otherwise it keeps the existing list. This ensures the `ports` field is always normalized to a list of integers, handling both inconsistent input formats.

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports | split(',')}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': [item.ports] | flatten}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports}) }}"
  loop: "{{ server_list }}"

Question 4

An administrator must parse an inventory file where hostnames are stored in YAML format under a list 'nodes'. The task needs to extract only hostnames that contain 'prod' in the name, then sort them in reverse order. Which combination of filters in a single Ansible expression achieves this?

Accepted Answer

nodes | select('match', '.*prod.*') | sort(reverse=True). Option A is correct because the `select` filter with the `match` test returns only list items that match the regex `'.*prod.*'`, i.e., hostnames containing 'prod'. The `sort(reverse=True)` then sorts the resulting list in descending alphabetical order, fulfilling both requirements in a single Ansible expression.

Answer

nodes | regex_search('prod') | sort(True)

Answer

nodes | map('regex_search', 'prod') | sort(reverse=True)

Answer

nodes | reject('match', '.*prod.*') | sort(reverse=True)

Question 5

A security team requires that all passwords in an Ansible vault be encrypted with a different key from the host variables. They want to use a custom lookup plugin that fetches secrets from an external API. Which plugin type should be developed?

Accepted Answer

Lookup plugin. A lookup plugin is the correct choice because it is designed to retrieve data from external sources (like an API) and return it as a string or list for use in Ansible playbooks. This aligns with the requirement to fetch secrets from an external API, and lookup plugins can be used directly in variables or templates without modifying the host state.

Answer

Module

Answer

Action plugin

Answer

Filter plugin

Question 6

An Ansible task uses the variable `{{ my_var | default(required=true) }}`. What happens if `my_var` is undefined?

Accepted Answer

The task fails with an error message. The `default(required=true)` filter in Ansible explicitly marks the variable as required. If `my_var` is undefined, the filter raises an error because it enforces that the variable must be provided, causing the task to fail with an error message. This is a deliberate mechanism to catch missing mandatory variables early in playbook execution.

Answer

The task skips the host

Answer

The task uses an empty string

Answer

The task uses the string 'required'

Question 7

A large-scale Ansible deployment processes a list of thousands of network devices. Using the `subelements` filter to iterate over interfaces is causing very slow playbook execution. Which approach can significantly improve performance?

Accepted Answer

Use a custom filter plugin in Python that uses list comprehensions. The `subelements` filter in Ansible processes nested data structures by iterating over each parent element and its child elements, which can be extremely slow for large datasets due to the overhead of Jinja2 template evaluation and repeated lookups. A custom filter plugin written in Python using list comprehensions avoids this overhead by executing native Python code directly, which is significantly faster because it operates at the interpreter level without the iterative Jinja2 expansion. This approach reduces the number of tasks and template evaluations, improving performance for thousands of network devices.

Answer

Use `with_nested` instead

Answer

Use `set_fact` with loops inside the task

Answer

Use `with_items` with `json_query` instead

Question 8

A playbook has a dictionary `config` that maps service names to ports. The team wants to iterate over both keys and values in a task. Which filter should be used to convert the dictionary into a list of key-value pairs?

Accepted Answer

dict2items. The `dict2items` filter is the correct choice because it converts a dictionary into a list of key-value pairs, each represented as a dictionary with `key` and `value` keys. This is the standard Ansible filter for iterating over both keys and values in a `loop` within a task, enabling access to `item.key` and `item.value`.

Answer

items2dict

Answer

flatten

Answer

json_query

Question 9

An Ansible Tower administrator notices that a job template using a dynamic inventory source from AWS EC2 is not updating when new instances are launched. The inventory source is set to update on launch. What is the most likely cause?

Accepted Answer

The AWS credential associated with the inventory source is invalid or expired.. Option B is correct because the most likely cause of a dynamic inventory source not updating is that the associated AWS credential is invalid or expired. When the 'update on launch' option is enabled, Ansible Tower attempts to refresh the inventory from the source before each job run. If the credential (e.g., AWS access key ID and secret access key) is no longer valid, the inventory update will fail silently or with an error, and the job will use stale cached data.

Answer

The inventory source cache timeout is set too high.

Answer

The 'update on launch' option is disabled.

Answer

The inventory source is configured as a custom script.

Question 10

Which TWO methods can be used to limit the hosts that a job template runs against when launching a job? (Choose exactly two.)

Accepted Answer

Using the 'LIMIT' field in the job template or at launch time.. Option C is correct because the 'LIMIT' field in Ansible Tower/AWX allows you to restrict the execution of a job template to a specific subset of hosts in the inventory, either by host name, group name, or pattern. This can be set in the job template definition or overridden at launch time, providing flexible targeting without modifying the inventory structure.

Answer

Assigning a specific credential to the job template.

Answer

Using the 'Tags' field to include only certain tasks.

Answer

Setting the 'Source Control Branch' in the project.

Question 11

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Option C is correct because Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 12

An Ansible Tower administrator needs to add a single host to an existing inventory. The host has a static IP address and requires SSH access with a specific username and private key. Which of the following is the correct approach?

Accepted Answer

Navigate to the inventory, click 'Add Host', enter the hostname and IP, and optionally define variables. Then create a credential for SSH and associate it with the host through a job template.. Option D is correct because in Ansible Tower, a host is added to an inventory via the 'Add Host' form, where you enter the hostname and IP address and optionally define variables. SSH credentials are not directly associated with a host; instead, they are created separately and then linked to the host through a job template, which uses the credential to authenticate when running playbooks against that host.

Answer

Add the host to an inventory group using the 'Add Group' option and specify the host details there.

Answer

Use the 'Add Host' form and in the 'Credentials' field, select the appropriate SSH credential from the drop-down.

Answer

Create a new credential first, then add the host directly within the credential definition.

Question 13

An Ansible Tower administrator needs to create a custom credential type that uses an SSH private key and a username. Which THREE components should be defined in the credential type's configuration?

Accepted Answer

"fields": [{"id": "ssh_key_data", "type": "string", "label": "SSH Private Key", "multiline": true, "secret": true}]. Option A is correct because the SSH private key must be defined as a field with `"type": "string"`, `"multiline": true` (since SSH keys are multi-line), and `"secret": true` (to encrypt the value in the database). This matches the standard Ansible Tower custom credential type schema for storing sensitive key material.

Answer

"fields": [{"id": "password", "type": "string", "label": "Password"}]

Answer

"fields": [{"id": "key_type", "type": "string", "label": "Key Type"}]

Question 14

A system administrator maintains a dynamic inventory script that queries a cloud provider API to build host lists. The script returns valid JSON, but after importing into Ansible Tower, the inventory shows zero hosts. The script is executable and placed in the expected project directory. What is the most likely cause?

Accepted Answer

The script has not been added as an inventory script in Ansible Tower's inventory scripts settings.. Option C is correct because Ansible Tower requires that a dynamic inventory script be explicitly registered as an inventory script in the Tower UI under 'Inventories' → 'Scripts'. Even if the script is executable and returns valid JSON, Tower will not execute it unless it is configured as a custom inventory script source. The script must be added via the 'Add' button in the Inventory Scripts section, where Tower will then use it to populate the inventory.

Answer

The script does not output JSON in the correct format expected by Ansible Tower.

Answer

The script does not have the executable permission set.

Answer

The script is written in a language that Ansible Tower does not support.

Question 15

An administrator needs to restrict access to an inventory so that only members of the 'WebTeam' can update its host variables and group memberships. Other users should be able to view the inventory but not modify it. Which role-based access control (RBAC) configuration should be applied?

Accepted Answer

Assign the 'WebTeam' the 'admin' role on the inventory and others the 'read' role. Option C is correct because in Ansible Tower/AWX, the 'admin' role on an inventory grants full update permissions (including host variables and group memberships), while the 'read' role provides view-only access. This directly satisfies the requirement that only WebTeam members can modify the inventory, and others can only view it.

Answer

Create a job template and assign 'WebTeam' the 'execute' role

Answer

Make the 'WebTeam' organization administrators and assign others the 'read' role on the organization

Answer

Assign the 'WebTeam' the 'use' role on the inventory and others the 'read' role

Question 16

An organization has multiple Ansible Tower projects that use different cloud providers. The security team mandates that cloud API credentials stored in Tower must have restricted access and be reusable across job templates without exposing the secret key. Which credential type and organization strategy best meets these requirements?

Accepted Answer

Create separate custom credential types for each cloud provider, marking the secret key fields as 'password' type, and add them to each job template as needed.. Option B is correct because Ansible Tower's custom credential types allow you to define fields with the 'password' type, which encrypts the secret key and hides it from view after entry. By creating separate custom credential types for each cloud provider, you can assign them to specific job templates, ensuring restricted access and reusability without exposing the secret key. This approach meets the security mandate by isolating credentials per provider and leveraging Tower's built-in encryption for sensitive fields.

Answer

Use a network credential to store the API token and assign it to the project.

Answer

Create a single custom credential type that includes both cloud provider API keys and reuse it across all projects.

Answer

Use a machine credential for each cloud provider and set the SSH key as the API secret.

Question 17

A team uses Ansible to update a web application across 10 servers with minimal downtime. Which playbook directive achieves one-at-a-time updates?

Accepted Answer

serial: 1. C is correct because the `serial: 1` directive in an Ansible playbook controls the number of hosts that are updated simultaneously. Setting `serial: 1` forces Ansible to execute the playbook on one host at a time, ensuring that the web application is updated sequentially across the 10 servers, which minimizes downtime by keeping the other 9 servers available during each individual update.

Answer

run_once: true

Answer

delegate_to: localhost

Answer

throttle: 1

Answer

forks: 10

Question 18

An OpenShift deployment is stuck in a degraded state after a rolling update. Which command helps diagnose the root cause by showing status conditions?

Accepted Answer

oc describe deployment/myapp. Option E is correct because `oc describe deployment/myapp` displays the full status conditions of the Deployment, including `Progressing`, `Available`, and `ReplicaFailure` conditions. When a rolling update leaves the Deployment in a degraded state, the `Conditions` field under `Status` explicitly shows the reason (e.g., `ProgressDeadlineExceeded` or `MinimumReplicasUnavailable`), which directly points to the root cause of the degradation.

Answer

oc rollout history

Answer

oc get pods

Answer

oc logs deployment/myapp

Answer

oc get events

Question 19

In OpenShift, a deployment must gradually shift traffic to new pods during a rolling update. Which default strategy achieves this?

Accepted Answer

RollingUpdate. The RollingUpdate strategy is the default deployment strategy in OpenShift (and Kubernetes) that gradually replaces old pods with new ones while maintaining application availability. It achieves this by incrementally scaling down the old ReplicaSet and scaling up the new one, controlled by parameters like maxSurge and maxUnavailable, ensuring a smooth transition of traffic to new pods.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Custom strategy

Answer

Recreate

Question 20

Which TWO options are valid techniques for rolling out updates to a subset of hosts before updating the rest? (Choose exactly two.)

Accepted Answer

Use serial: 3 to update hosts in batches of 3.. Option A is correct because the `serial: 3` directive in an Ansible playbook limits the number of hosts updated in each batch, allowing you to roll out changes to a subset of hosts before proceeding to the next batch. This is a native Ansible mechanism for controlling rolling updates by specifying the batch size, ensuring that only three hosts are updated at a time, with the play pausing between batches.

Answer

Use inventory host variables to mark hosts for early update and use conditional tasks.

Answer

Use the --forks=1 option to update one host at a time.

Answer

Use the 'strategy: random' directive in the playbook.