EX294 Practice Test 3 — 25 Questions

Question 1

An administrator has a requirements.yml file specifying roles from multiple sources: a public Galaxy server, a private Git repository, and a local path. They want to install all roles into the roles directory of the current project. Which command will achieve this?

Accepted Answer

ansible-galaxy install -r requirements.yml --roles-path ./roles. Option B is correct because `ansible-galaxy install -r requirements.yml --roles-path ./roles` reads the requirements file and specifies the target directory for role installation. Option A is incorrect because it uses `collection install`, which installs collections, not roles. Option C is incorrect because `-p .` installs roles into the current directory, not the `roles` subdirectory. Option D is incorrect because while it installs roles, the `--force` flag is unnecessary and may overwrite existing roles without need.

Answer

ansible-galaxy collection install -r requirements.yml

Answer

ansible-galaxy install -r requirements.yml -p .

Answer

ansible-galaxy role install --force -r requirements.yml

Question 2

A playbook needs to load encrypted variables from a file vault.yml. The vault password is stored in a file vault-pass with restricted permissions. Which method securely loads the variables when running the playbook?

Accepted Answer

Run ansible-playbook playbook.yml --vault-password-file vault-pass. Option C is correct because the `--vault-password-file` flag allows Ansible to read the vault password from a file with restricted permissions, enabling non-interactive decryption of `vault.yml` without exposing the password in the process list or requiring manual input. This method is secure when the vault password file has proper permissions (e.g., 600) and is stored in a controlled location.

Answer

Use include_vars: file: vault.yml without any additional configuration.

Answer

Run ansible-playbook with --ask-vault-pass to prompt for the password.

Answer

Set the environment variable ANSIBLE_VAULT_PASSWORD_FILE in the user's profile.

Question 3

Refer to the exhibit. An Ansible playbook task fails with 'Missing sudo password'. The playbook runs against a server where the remote user 'admin' has sudo privileges but requires a password. Which configuration change would resolve this issue?

Accepted Answer

Set ansible_become_password or use the -K flag when running the playbook.. The error 'Missing sudo password' occurs because Ansible needs the sudo password for the remote user. Option A provides the password either by setting ansible_become_password in inventory or using the -K flag to prompt for it. Option B is incorrect because switching to su does not solve the password issue and is unnecessary. Option C is incorrect because removing become_user doesn't address the password requirement. Option D is incorrect because changing become_user to root doesn't provide the needed password.

Answer

Change become_method to su to avoid password prompts.

Answer

Remove the become_user line and rely on default root.

Answer

Change become_user to root.

Question 4

Your team uses ansible-pull to manage configuration of a large number of remote nodes. Each node is configured to pull the latest playbook from a Git repository every 30 minutes. Recently, some nodes started reporting 'ERROR! the role 'base' was not found'. The playbook depends on roles from a requirements.yml file that is stored in the same repository. The ansible-pull command on each node uses the default roles path (~/.ansible/roles). The Git repository contains the requirements.yml file but does not contain the actual role directories. What is the most likely cause and solution?

Accepted Answer

Add a pre_task to the playbook that runs 'ansible-galaxy install -r requirements.yml' before the roles are used.. Option C is correct because ansible-pull does not automatically install roles from requirements.yml; the playbook should include a pre_task that runs 'ansible-galaxy install -r requirements.yml' before using the roles. Option A is incorrect because the roles are already in the repository? No, they are not. Option B is incorrect because ansible-pull does not use a local roles path by default; the issue is missing installation. Option D is incorrect because the control node is not involved in ansible-pull.

Answer

Run ansible-galaxy install on the control node and distribute the roles via a separate channel.

Answer

Add the role directories directly to the Git repository and modify the playbook to reference them with a relative path.

Answer

Set the 'roles_path' in ansible.cfg on each node to include the repository's roles directory.

Question 5

Which TWO statements about Ansible Execution Environments (EE) are true?

Accepted Answer

Execution environments are container images built with ansible-builder.. Option C is correct because execution environments are container images that package Ansible Core, collections, and Python dependencies, and they are built using the `ansible-builder` tool. The `ansible-builder` reads a definition file (e.g., `execution-environment.yml`) to construct a container image that includes all necessary components for running Ansible automation in a consistent, isolated environment.

Answer

Execution environments are primarily used for developing new Ansible modules.

Answer

Execution environments use ansible-navigator as the default entrypoint.

Answer

Execution environments can only be used with the ansible-navigator command-line tool.

Question 6

An operations team is designing a rolling update for a stateful application that requires quorum (minimum 3 out of 5 nodes online). They plan to use Ansible's serial keyword. Which serial value ensures the update proceeds without breaking quorum while still being efficient?

Accepted Answer

serial: 2. Option A is correct because setting serial: 2 ensures that only 2 nodes are taken down at a time during the rolling update. With a quorum requirement of 3 out of 5 nodes, taking down 2 nodes leaves 3 online, maintaining quorum. This is the most efficient value that does not risk breaking quorum.

Answer

serial: 1

Answer

serial: 3

Answer

serial: 5

Question 7

Which TWO options are best practices for coordinating rolling updates with Ansible? (Choose exactly two.)

Accepted Answer

Use the serial keyword to update hosts in batches.. Option B is correct because the `serial` keyword in Ansible controls how many hosts are updated at a time during a rolling update, allowing you to update hosts in batches to maintain service availability. This is a best practice for coordinating rolling updates as it prevents overwhelming the infrastructure and ensures that a subset of hosts remains operational while others are being updated.

Answer

Set ignore_errors: yes to ensure the playbook continues even if some hosts fail.

Answer

Use the default serial setting (all hosts) for simplicity.

Answer

Run all hosts in parallel to minimize total update time.

Question 8

A systems administrator is deploying Ansible Automation Platform 2.4 using the provided setup script. The installation fails with the error shown in the exhibit. Based on the exhibit, what is the most likely cause of the failure?

Accepted Answer

The PostgreSQL service is not running on the database server.. The error exhibit indicates that the installer cannot connect to the PostgreSQL database. The most common cause of this failure is that the PostgreSQL service is not running on the database server, preventing the Ansible Automation Platform setup script from establishing a connection. Without the database service active, the installer cannot proceed with the deployment.

Answer

The installer requires a local PostgreSQL database; using a remote database is not supported.

Answer

The database password specified in setup.sh does not match the actual PostgreSQL password.

Answer

SELinux is blocking the ansible-navigator process from reaching the database.

Question 9

An Ansible playbook uses the `ansible_password` variable to connect to a Windows host. The value is stored in an encrypted Ansible Vault file. Which credential type in Automation Controller would allow the vault password to be supplied at runtime?

Accepted Answer

Vault credential. Option C is correct because Automation Controller's Vault credential type is specifically designed to provide the vault password needed to decrypt Ansible Vault-encrypted variables like `ansible_password`. When a job runs, the controller uses this credential to unlock the vault file, allowing the playbook to access the encrypted value at runtime without exposing the plaintext password.

Answer

Cloud credential

Answer

Machine credential

Answer

Network credential

Question 10

Which THREE of the following are best practices for managing credentials in Ansible Automation Controller?

Accepted Answer

Restrict credential 'Use' permissions to specific users or teams. Option C is correct because Ansible Automation Controller's Role-Based Access Control (RBAC) allows administrators to assign granular 'Use' permissions to specific users or teams, ensuring that only authorized entities can leverage a credential for job runs. This prevents unauthorized access to sensitive secrets and aligns with the principle of least privilege, which is a core security best practice in automation environments.

Answer

Avoid using external secret management systems; keep all secrets in Automation Controller

Answer

Share the same credential across multiple organizations for simplicity

Question 11

An Ansible playbook is designed to run on a group of database servers. The administrator wants to ensure that a task runs only on the primary database server, which is defined in the inventory with a variable 'primary: true'. Which conditional should be used?

Accepted Answer

when: primary. Option B is correct because the `when` conditional in Ansible evaluates a Jinja2 expression to determine whether a task should execute. By using `when: primary`, the task will run only on hosts where the inventory variable `primary` is defined and evaluates to `true` (a truthy value). This directly meets the requirement to target the primary database server.

Answer

ignore_errors: yes

Answer

run_once: true

Answer

delegate_to: "{{ primary }}"

Question 12

When building an execution environment with ansible-builder, a developer notices that the build process fails with an error about missing dependencies. The developer wants to ensure all required Python packages are installed in the execution environment. Which file should be used to specify additional Python packages?

Accepted Answer

requirements.txt. In Ansible Builder, the `requirements.txt` file is used to specify additional Python packages that should be installed in the execution environment. When building an execution environment, Ansible Builder reads this file and installs the listed packages via pip, ensuring all required Python dependencies are present.

Answer

meta/runtime.yml

Answer

galaxy.yml

Answer

bindep.txt

Question 13

A user wants to run a playbook that uses a module from 'myorg.mycollection'. The playbook is located in /home/user/projects. Which of the following is true about the collection discovery?

Accepted Answer

Ansible will automatically find the collection in the default search path.. Option D is correct because Ansible automatically searches for collections in the default search path, which includes the collections directory adjacent to the playbook. Since the playbook is located in /home/user/projects, Ansible will look in /home/user/projects/collections/ansible_collections/myorg/mycollection, among other default paths, without requiring any environment variable or manual configuration.

Answer

The user must set the ANSIBLE_COLLECTIONS_PATH environment variable.

Answer

The collection is not installed, so the playbook will fail.

Answer

Ansible will look only in /usr/share/ansible/collections.

Question 14

A playbook needs to set a fact 'total_memory' by summing the 'memory_mb' values from a list of servers. Which filter should be used?

Accepted Answer

{{ servers | map(attribute='memory_mb') | sum }}. Option A is correct because it uses the `map` filter with the `attribute` parameter to extract the `memory_mb` value from each dictionary in the list, then pipes the resulting list of integers into the `sum` filter to compute the total. This is the standard Ansible idiom for summing a specific attribute across a list of dictionaries.

Answer

Answer

Answer

Question 15

The debug output shows 'changed' even when the firewall rule already existed. Which filter issue could cause this?

Accepted Answer

The task should use 'immediate: yes' to reload the firewall, otherwise the module always reports changed.. C is correct because the `firewalld` module in Ansible, by default, operates in 'offline' mode (immediate: no), meaning it only modifies the permanent configuration without applying changes to the running runtime firewall. Even if a rule already exists in the permanent configuration, the module will report 'changed' because it still attempts to add the rule to the runtime zone unless `immediate: yes` is explicitly set to reload the firewall and synchronize the runtime state. This behavior is specific to how `firewalld` separates permanent and runtime rule sets.

Answer

The 'changed' key is misspelled as 'change' in the filter.

Answer

The variable 'fw_result' is undefined because the task failed.

Answer

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Question 16

An organization uses custom Ansible plugins stored in a collection. A junior admin reports that after updating the collection to version 2.0.0, a playbook that uses a custom filter plugin fails with 'undefined filter'. What is the most likely cause?

Accepted Answer

The filter plugin was placed in the wrong directory inside the collection.. In Ansible collections, filter plugins must reside in the `plugins/filter/` directory within the collection structure. If the plugin is placed in the wrong directory (e.g., `plugins/modules/` or `plugins/lookup/`), Ansible will not load it as a filter, resulting in an 'undefined filter' error. The collection update to version 2.0.0 likely reorganized the directory structure, causing the filter to be misplaced.

Answer

The playbook uses an outdated syntax that is incompatible with the new collection.

Answer

The playbook does not use the fully qualified collection name (FQCN) for the filter.

Answer

The collection's metadata file galaxy.yml is missing a dependency declaration.

Question 17

A system administrator is managing Ansible Tower and wants to use an Azure Resource Manager credential to provision virtual machines. However, the credential fails authentication with the error '401 Unauthorized'. Which action should the administrator take to resolve the issue?

Accepted Answer

Verify the client secret in the credential matches the one configured in Azure Active Directory.. The 401 Unauthorized error when using an Azure Resource Manager credential in Ansible Tower indicates that the authentication token or secret used to authenticate with Azure Active Directory is invalid or mismatched. Option B is correct because verifying that the client secret stored in the Tower credential exactly matches the one configured in Azure Active Directory resolves the authentication failure, as Azure AD uses OAuth 2.0 client credentials flow where the client secret is required for token acquisition.

Answer

Regenerate the SSH key pair and update the credential.

Answer

Add the credential as a playbook-level variable instead of a Tower credential.

Answer

Generate a new API token from Azure and paste it into the credential.

Question 18

A playbook uses the 'debug' module to print a variable 'my_var' but the output is 'VARIABLE IS UNDEFINED'. The variable is defined in group_vars/all.yml. Which filter could be used to provide a default value and avoid this error?

Accepted Answer

{{ my_var | default('fallback') }}. Option B is correct because the `default` filter in Ansible provides a fallback value when a variable is undefined, preventing the 'VARIABLE IS UNDEFINED' error. Using `{{ my_var | default('fallback') }}` ensures that if `my_var` is not defined in group_vars/all.yml or any other precedence level, the string 'fallback' is used instead of causing a failure.

Answer

Answer

Answer

Question 19

A team is writing an Ansible role to configure a web server. They want to include default variables that can be easily overridden by playbook variables. Which directory and file should they use to define these variables?

Accepted Answer

defaults/main.yml. In Ansible roles, default variables are defined in the `defaults/main.yml` file. These variables have the lowest precedence, meaning they can be easily overridden by playbook variables, inventory variables, or any other variable source with higher precedence. This design allows role authors to provide sensible defaults while giving users the flexibility to customize behavior without modifying the role itself.

Answer

vars/defaults.yml

Answer

default_vars/main.yml

Answer

vars/main.yml

Question 20

Which TWO statements are true regarding the deployment of Ansible Automation Platform in a highly available configuration?

Accepted Answer

The automation controller requires a PostgreSQL database that must be configured with replication for high availability.. Option C is correct because the automation controller in Ansible Automation Platform requires a PostgreSQL database, and for high availability (HA), that database must be configured with replication (e.g., streaming replication or Patroni) to ensure failover and data durability. Without database replication, a single database instance becomes a single point of failure, defeating the purpose of an HA deployment.

Answer

The automation hub requires an external PostgreSQL database to store collections and execution environments.

Answer

Execution nodes must have direct network access to the automation controller database.

Answer

The automation controller can use an embedded SQLite database for production deployments.