EX294 Practice Test 3 — 25 Questions

Question 1

Refer to the exhibit. A role 'timezone' sets the timezone twice to different values. The role also depends on 'ntp'. After running a playbook that applies this role to server1, what is the timezone on server1?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

America/New_York

Answer

The timezone is not set because of the dependency on ntp.

Answer

UTC

Answer

An error occurs because two tasks set the timezone.

Question 2

An admin attempts to build an execution environment using the exhibited files. The build fails with an error about incompatible Python dependency. What is the most likely cause?

Accepted Answer

The Python requirements.txt tries to install a version of Ansible that conflicts with the version in the base image.. The build fails because the Python `requirements.txt` file attempts to install a version of Ansible that conflicts with the version already present in the base image `ee-minimal-rhel8`. Execution environments are designed to include a specific Ansible version in the base image; adding a different version via pip creates a dependency conflict that breaks the build.

Answer

The execution-environment.yml file uses incorrect syntax for the 'dependencies' section.

Answer

The collections in requirements.yml are not fully qualified.

Answer

The base image 'ee-minimal-rhel8' is not a valid execution environment base image.

Question 3

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. `ansible-vault` encrypts variable files at rest using AES-256, allowing sensitive data like passwords or API keys to be stored securely in version control. When a playbook runs, the vault password must be provided (e.g., via `--ask-vault-pass` or a vault password file), and Ansible decrypts the file in memory only, never writing plaintext to disk. This ensures that sensitive values are not exposed in the playbook source code or logs.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 4

Refer to the exhibit. A playbook includes this vars file and runs `systemctl restart httpd`. The playbook fails because it cannot decrypt the vault. Which of the following is the most likely cause?

Accepted Answer

The vault password is not provided.. The error 'cannot decrypt the vault' indicates that Ansible is unable to decrypt the vault-encrypted variable file. This occurs when the vault password is not provided via `--ask-vault-pass`, `--vault-password-file`, or the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable. Without the correct password, Ansible cannot decrypt the vault, causing the playbook to fail.

Answer

The vault ID is missing.

Answer

The variable db_password is not used in the playbook.

Answer

The vault file is corrupted.

Question 5

A playbook uses `{{ my_var | default('fallback') }}`. What is the effect?

Accepted Answer

If `my_var` is undefined, the expression evaluates to 'fallback'.. The `default` filter in Ansible (also known as `d()`) returns the specified fallback value only when the variable is undefined. If `my_var` is defined but empty or None, the filter returns the variable's value (empty string or None), not the fallback. This behavior is specific to the `default` filter's default mode; to also catch empty or None values, you must use `default('fallback', true)`.

Answer

If `my_var` is defined but empty, the expression evaluates to 'fallback'.

Answer

If `my_var` is defined but equal to None, the expression evaluates to 'fallback'.

Answer

The filter raises an error because 'default' is not a valid filter.

Question 6

What is the purpose of the 'meta: flush_handlers' task?

Accepted Answer

Force handlers to run immediately. The 'meta: flush_handlers' task in Ansible is used to force any pending handler notifications to run immediately at that point in the play, rather than waiting until the end of the play. This is correct because it ensures that handlers triggered by earlier tasks execute right away, which is essential when subsequent tasks depend on the state changes those handlers make (e.g., restarting a service before configuring it further).

Answer

Restart services immediately

Answer

Clear the handler queue

Answer

Wait for handlers to complete

Question 7

An Ansible playbook includes a role that defines default variables in 'defaults/main.yml' and role variables in 'vars/main.yml'. A playbook sets the same variable in the play's 'vars' section. Which variable value takes precedence?

Accepted Answer

Play vars. In Ansible, variable precedence is hierarchical, and play vars (set directly in the play's `vars` section) have a higher priority than role defaults and role vars. Specifically, play vars override role vars, which in turn override role defaults. Therefore, when the same variable is defined in all three locations, the play vars value takes precedence.

Answer

Role defaults

Answer

Inventory group vars

Answer

Role vars

Question 8

An administrator must parse an inventory file where hostnames are stored in YAML format under a list 'nodes'. The task needs to extract only hostnames that contain 'prod' in the name, then sort them in reverse order. Which combination of filters in a single Ansible expression achieves this?

Accepted Answer

nodes | select('match', '.*prod.*') | sort(reverse=True). The `select` filter with the `match` test returns only list items that match the regex `'.*prod.*'`, i.e., hostnames containing 'prod'. The `sort(reverse=True)` then sorts the resulting list in descending alphabetical order, fulfilling both requirements in a single Ansible expression.

Answer

nodes | regex_search('prod') | sort(True)

Answer

nodes | map('regex_search', 'prod') | sort(reverse=True)

Answer

nodes | reject('match', '.*prod.*') | sort(reverse=True)

Question 9

A team uses Ansible to update a web application across 10 servers with minimal downtime. Which playbook directive achieves one-at-a-time updates?

Accepted Answer

serial: 1. C is correct because the `serial: 1` directive in an Ansible playbook controls the number of hosts that are updated simultaneously. Setting `serial: 1` forces Ansible to execute the playbook on one host at a time, ensuring that the web application is updated sequentially across the 10 servers, which minimizes downtime by keeping the other 9 servers available during each individual update.

Answer

run_once: true

Answer

delegate_to: localhost

Answer

throttle: 1

Answer

forks: 10

Question 10

A workflow template in automation controller consists of three job templates that must run sequentially with different credentials. The first job template uses a machine credential to provision a VM, the second uses a network credential to configure the switch, and the third uses a cloud credential to deploy the application. To secure the credential usage, what should the administrator configure?

Accepted Answer

Set each job template to use the appropriate credential and ensure workflow node permissions are set to 'use credential'.. Each job template can have its own credential defined. The workflow template does not directly hold credentials; it uses the credentials assigned to each job template. Option A (single credential) is not appropriate. Option C (validation rules) does not exist. Option D (assign to workflow) is not possible.

Answer

Create a single credential that covers all three environments.

Answer

Define credential validation rules in the workflow node properties.

Answer

Assign all three credentials to the workflow template directly.

Question 11

Refer to the exhibit. A user includes this in the execution-environment.yml. The build process fails because the second collection cannot be resolved. What is the most likely reason?

Accepted Answer

The source URL is not a valid Galaxy server endpoint.. The execution-environment.yml references a Galaxy server endpoint that is not a valid Ansible Galaxy server. Ansible Builder resolves collections from Galaxy servers, and if the URL does not point to a recognized Galaxy API endpoint (e.g., https://galaxy.ansible.com), the build process cannot fetch the collection. The error indicates the second collection cannot be resolved, which directly points to an invalid or unreachable Galaxy server URL.

Answer

The format of the version constraint is invalid.

Answer

The source URL does not include the required endpoint like '/api/v3/'.

Answer

The second collection is not authorized for download.

Question 12

Based on the exhibit, what is the purpose of the `galaxy` dependency entry?

Accepted Answer

Define which Ansible collections to install in the execution environment.. In the context of Ansible execution environments (EEs), the `galaxy` key within the `dependencies` section of the `execution-environment.yml` file specifies a list of Ansible collections to be installed from Ansible Galaxy or an Automation Hub. This allows the EE to include the necessary content collections required for playbook execution, ensuring all roles and modules are available inside the container.

Answer

Set the base container image.

Answer

Specify Python packages to install via pip.

Answer

Configure environment variables for the container.

Question 13

A security team requires that all automation controller job logs be forwarded to an external SIEM system. Which integration should be used?

Accepted Answer

Automation controller's built-in logging aggregator. Automation controller (formerly Ansible Tower) includes a built-in logging aggregator that can forward job logs to external SIEM systems via supported protocols such as HTTPS, TCP, or UDP. This integration is configured directly in the controller's settings, requiring no additional scripts or system-level changes, making it the correct and supported method for centralized log forwarding.

Answer

Ansible Log Forwarder

Answer

Custom callback plugin

Answer

rsyslog configuration

Question 14

An Ansible automation team is designing a playbook to manage network devices. They need to ensure that the playbook can handle transient network failures by retrying failed tasks a specific number of times with a delay between retries. Which approach should they use?

Accepted Answer

Use the `until` loop with `retries` and `delay` parameters on the task.. The `until` loop with `retries` and `delay` parameters is the correct approach because it allows a task to be retried a specified number of times with a configurable pause between attempts, directly addressing transient network failures. This is a built-in Ansible feature for handling intermittent issues without additional error-handling constructs.

Answer

Set `max_fail_percentage` in the play to 0 and use `ignore_errors: yes` with a rescue block.

Answer

Use the `throttle` keyword to limit concurrent tasks and rely on idempotency.

Answer

Set `serial: 1` on the play to ensure only one host is processed at a time and rely on idempotency.

Question 15

The debug output shows 'changed' even when the firewall rule already existed. Which filter issue could cause this?

Accepted Answer

The task should use 'immediate: yes' to reload the firewall, otherwise the module always reports changed.. C is correct because the `firewalld` module in Ansible, by default, operates in 'offline' mode (immediate: no), meaning it only modifies the permanent configuration without applying changes to the running runtime firewall. Even if a rule already exists in the permanent configuration, the module will report 'changed' because it still attempts to add the rule to the runtime zone unless `immediate: yes` is explicitly set to reload the firewall and synchronize the runtime state. This behavior is specific to how `firewalld` separates permanent and runtime rule sets.

Answer

The 'changed' key is misspelled as 'change' in the filter.

Answer

The variable 'fw_result' is undefined because the task failed.

Answer

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Question 16

A team has developed several roles that share common variables. They want to organize these variables in a central file. Where should they place this file so it is automatically loaded by all roles?

Accepted Answer

In the playbook directory as group_vars/all.yml. Placing a file in the playbook directory as group_vars/all.yml makes it automatically loaded by all roles. Ansible automatically includes any YAML files in the group_vars directory that match group names, and the special group 'all' applies to every host. This centralizes shared variables without requiring explicit imports in each role.

Answer

In the inventory directory as host_vars/localhost.yml

Answer

In a common role's vars/main.yml

Answer

In a common role's defaults/main.yml

Question 17

A junior admin created a custom credential type for a third-party API. When running a job that uses this credential, the job fails with 'type object 'Credentials' has no attribute' error. What is the most likely issue?

Accepted Answer

The 'inputs' section in the credential type definition has a misconfigured field name. The error 'type object 'Credentials' has no attribute' typically occurs when the credential type definition's 'inputs' section references a field name that does not match the actual attribute expected by the credential plugin or injector. In Ansible Tower/AWX, the 'inputs' section defines the fields a user fills in (e.g., username, password), and if a field name is misspelled or mismatched with what the credential plugin expects, the plugin cannot find the attribute, causing this error. Option A is correct because a misconfigured field name in 'inputs' directly leads to this attribute lookup failure.

Answer

The 'injectors' section in the credential type definition is missing

Answer

The credential is not assigned to the job template

Answer

The job template is missing the required extra variables

Question 18

An organization uses a private Git repository to store Ansible content collections. They want to automate the building of execution environments that include these collections. Which approach is recommended?

Accepted Answer

Build the collection manually, publish it to a private Automation Hub, then reference it in the EE.. The recommended workflow for including private collections in an execution environment is to build the collection, publish it to a private Automation Hub, and then reference it in the `execution-environment.yml` file. This ensures the collection is available as a signed, versioned artifact that `ansible-builder` can pull during the build process, maintaining integrity and reproducibility without exposing Git credentials or requiring network access during build.

Answer

Store the collection tarball in a Git LFS and use an ADD command in the base image.

Answer

Add the Git repository as a source in the execution-environment.yml using the 'git' type.

Answer

Use ansible-builder to clone the repository during build with a pre-build script.

Question 19

A user wants to authenticate against Ansible Automation Controller using LDAP. They configure the LDAP settings in the controller UI. After saving, they test the connection and it succeeds. However, when an LDAP user tries to log in, they get an authentication failure. What is the most likely issue?

Accepted Answer

The user has not been mapped to an organization within the LDAP configuration.. In Ansible Automation Controller, LDAP users must be explicitly mapped to an organization within the LDAP configuration. Without this mapping, the user is authenticated by the LDAP server but the controller has no authorization context (e.g., organization membership) to allow login. Option B correctly identifies this missing organization mapping as the most likely cause.

Answer

The user is not a member of the required LDAP group that is mapped to a team.

Answer

The controller is case-sensitive and the user entered username in wrong case.

Answer

The LDAP server is configured to use TLS, but the controller uses SAML.

Question 20

An Ansible playbook needs to dynamically include a set of variables based on the environment (dev/staging/prod). The developer wants to use a variable from a lookup plugin that returns a YAML file path. Which lookup plugin is most appropriate for fetching a file’s contents?

Accepted Answer

file. The `file` lookup plugin is the most appropriate for fetching the contents of a file from the control node, as it reads the entire file and returns its content as a string. This is ideal for dynamically including variable files based on environment (e.g., `{{ lookup('file', 'vars/{{ env }}.yml') }}`), allowing the playbook to load environment-specific YAML data.

Answer

env

Answer

pipe

Answer

template