EX294 Practice Test 5 — 25 Questions

Question 1

Your team uses ansible-pull to manage configuration of a large number of remote nodes. Each node is configured to pull the latest playbook from a Git repository every 30 minutes. Recently, some nodes started reporting 'ERROR! the role 'base' was not found'. The playbook depends on roles from a requirements.yml file that is stored in the same repository. The ansible-pull command on each node uses the default roles path (~/.ansible/roles). The Git repository contains the requirements.yml file but does not contain the actual role directories. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a pre_task to the playbook that runs 'ansible-galaxy install -r requirements.yml' before the roles are used.. Ansible-pull does not automatically install roles from requirements.yml; the playbook should include a pre_task that runs 'ansible-galaxy install -r requirements.yml' before using the roles. Option A is incorrect because the roles are already in the repository? No, they are not. Option B is incorrect because ansible-pull does not use a local roles path by default; the issue is missing installation. Option D is incorrect because the control node is not involved in ansible-pull.

Answer

Run ansible-galaxy install on the control node and distribute the roles via a separate channel.

Answer

Add the role directories directly to the Git repository and modify the playbook to reference them with a relative path.

Answer

Set the 'roles_path' in ansible.cfg on each node to include the repository's roles directory.

Question 2

An Ansible playbook uses a vault-encrypted variable `db_password` from a vars file. The playbook fails with 'Decryption failed' error. Which of the following could be the cause?

Accepted Answer

The vault ID in the encrypted file does not match the provided vault ID.. Ansible Vault supports multiple vault IDs, and the vault ID used to encrypt the variable must match the vault ID provided at runtime (via `--vault-id` or `ansible.cfg`). If the encrypted file was created with vault ID 'prod' but the playbook is run with vault ID 'dev', Ansible will fail with 'Decryption failed' because it cannot find a matching password for that ID.

Answer

The vault password is correct but the file is corrupted.

Answer

The vault password file path is incorrect in ansible.cfg.

Answer

The variable is not encrypted but marked as `!vault`.

Question 3

A developer wants to create a new Ansible collection from a skeleton template. Which command should be used?

Accepted Answer

`ansible-galaxy collection init my_namespace.my_collection`. The correct command is `ansible-galaxy collection init my_namespace.my_collection`, which creates a new collection skeleton with the required directory structure and metadata files. This is the official Ansible command for bootstrapping a collection from a template.

Answer

`ansible-galaxy collection generate my_namespace.my_collection`

Answer

`ansible-galaxy collection create my_namespace.my_collection`

Answer

`ansible-galaxy collection start my_namespace.my_collection`

Question 4

An operations team is planning a rolling update of a production OpenShift cluster running Red Hat Enterprise Linux CoreOS nodes. Which three practices should be followed to ensure minimal downtime and proper rollback capability?

Accepted Answer

Use canary nodes to validate the update before full rollout.. Using canary nodes allows you to validate the update on a small subset of nodes before rolling it out to the entire cluster. This practice minimizes the blast radius of potential issues, ensuring that if the update causes problems, only the canary nodes are affected, and the rest of the cluster remains stable. It directly supports minimal downtime by catching failures early and provides a clear rollback point by isolating the test group.

Answer

Monitor cluster health via `oc get clusterversion` after each node update.

Answer

Place nodes in the same Availability Zone to simplify rollback.

Question 5

Which TWO statements about machine credentials in Ansible Tower are correct? (Choose two.)

Accepted Answer

Machine credentials can specify a 'become_method' for privilege escalation.. Ansible Tower machine credentials include a 'Become Method' field that allows you to specify privilege escalation methods such as 'sudo', 'su', 'pbrun', or 'pfexec'. This setting is used by Ansible to escalate privileges on the target machine after the initial SSH connection is established, enabling tasks that require higher-level permissions.

Answer

The SSH private key file automatically includes privilege escalation settings.

Answer

The username field is optional when using an SSH key.

Answer

SSH key credentials require a password field to be filled in.

Question 6

A team uses Ansible to update a database cluster with one primary and two replicas. The goal is zero downtime. Which update order is the safest?

Accepted Answer

Update replicas first, then the primary.. Updating replicas first ensures that if the update introduces a regression, it affects only the read-only replicas, which can be quickly rolled back without impacting write availability. Once replicas are confirmed healthy, the primary is updated and a controlled failover (e.g., using `patronictl switchover` or `repmgr standby switchover`) promotes a replica to primary, minimizing downtime to seconds. This order aligns with the principle of reducing blast radius and maintaining quorum in a cluster.

Answer

Update in random order.

Answer

Update all nodes simultaneously.

Answer

Update the primary first, then replicas.

Question 7

A user wants to run a playbook that uses a module from 'myorg.mycollection'. The playbook is located in /home/user/projects. Which of the following is true about the collection discovery?

Accepted Answer

Ansible will automatically find the collection in the default search path.. Ansible automatically searches for collections in the default search path, which includes the collections directory adjacent to the playbook. Since the playbook is located in /home/user/projects, Ansible will look in /home/user/projects/collections/ansible_collections/myorg/mycollection, among other default paths, without requiring any environment variable or manual configuration.

Answer

The user must set the ANSIBLE_COLLECTIONS_PATH environment variable.

Answer

The collection is not installed, so the playbook will fail.

Answer

Ansible will look only in /usr/share/ansible/collections.

Question 8

An Ansible role has tasks that need to run in a specific order, and some tasks must use a different shell interpreter. Which feature allows the role to control task execution order and environment settings?

Accepted Answer

Use the block directive to order tasks and a vars file for interpreter.. The block directive groups tasks that run in the order they appear, allowing control over task execution order within a role. Environment settings, such as a different shell interpreter, can be achieved using a vars file to define variables like ansible_shell_executable, which applies to tasks in the block. Option A is incorrect because the meta module (ansible.builtin.meta) does not declare role dependencies; role dependencies are defined in meta/main.yml. Options B and C are incorrect as strategy plugins and tags do not directly control task order or interpreter settings.

Answer

Use the meta module to declare dependencies and the environment directive in tasks.

Answer

Use the strategy plugin and a custom lookup to set interpreter.

Answer

Use tags to control execution order and a custom inventory script.

Question 9

Refer to the exhibit. The administrator wants to run a playbook that installs a package on all webservers. Which command will use the existing configuration and inventory correctly?

Accepted Answer

ansible-playbook site.yml. The ansible.cfg sets inventory=./inventory and roles_path=./roles. The playbook should be run with ansible-playbook, which reads the configuration automatically. The -i flag is not needed because inventory is defined in ansible.cfg.

Answer

ansible-playbook -e 'ansible_python_interpreter=/usr/bin/python3' site.yml

Answer

ansible webservers -m package -a 'name=httpd state=present'

Answer

ansible-playbook -i inventory site.yml

Question 10

An operations team is designing a rolling update for a stateful application that requires quorum (minimum 3 out of 5 nodes online). They plan to use Ansible's serial keyword. Which serial value ensures the update proceeds without breaking quorum while still being efficient?

Accepted Answer

serial: 2. Setting serial: 2 ensures that only 2 nodes are taken down at a time during the rolling update. With a quorum requirement of 3 out of 5 nodes, taking down 2 nodes leaves 3 online, maintaining quorum. This is the most efficient value that does not risk breaking quorum.

Answer

serial: 1

Answer

serial: 3

Answer

serial: 5

Question 11

Refer to the exhibit. The administrator notices that the handler 'restart httpd' runs even though the httpd service was already running. Which change would ensure the handler only runs if the service configuration changes?

Accepted Answer

Use a separate handler for configuration changes and notify it from tasks that modify configuration files.. The handler is notified by the 'Install httpd' task, which changes only on initial installation or update. However, the handler runs after the 'Ensure httpd is running' task, which is unnecessary. To avoid restarting when the service is already running and no configuration changed, the administrator should add a 'listen' directive or use a separate handler for configuration changes.

Answer

Add a condition to the handler to check if httpd is already running.

Answer

Set the handler to 'state: reloaded' instead of 'restarted'.

Answer

Move the 'Ensure httpd is running' task before the handler notification.

Question 12

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 13

A systems administrator at a growing company uses Red Hat Ansible Automation Platform to manage configuration of web servers. They have a job template named 'Web Server Config' that runs a playbook to apply security hardening. The playbook includes variables encrypted with Ansible Vault using the default vault ID. The administrator has created a credential of type 'Ansible Vault Password' in Automation Controller and assigned it to the job template. When the job runs, it fails with the error: 'Decryption failed (no vault secrets would be found that would decrypt)'. However, other job templates that use the same vault credential run successfully. The administrator checks that the vault password is correct and that the credential is properly assigned. They also verify that the playbook's path is correct and the inventory is populated. What is the most likely cause of the failure?

Accepted Answer

The playbook references a different vault id than the one in the credential.. Since other job templates with the same credential succeed, the credential is valid and assigned. The error 'no vault secrets would be found' typically occurs when the playbook references a vault id that was not provided. The most likely cause is a vault id mismatch between the playbook and the credential.

Answer

The playbook has a syntax error.

Answer

The vault password file is missing from the controller.

Answer

The vault credential is not assigned to this specific job template.

Question 14

A system administrator wants to build an Ansible execution environment using ansible-builder. Which file format is required to define the base image, dependencies, and additional Python packages for the build?

Accepted Answer

execution-environment.yml. `ansible-builder` requires an `execution-environment.yml` file to define the build context, including the base image (under `version: 1`), system-level dependencies (under `dependencies: system:`), and additional Python packages (under `dependencies: python:`). This file is the mandatory definition file for building an Ansible Execution Environment (EE) using `ansible-builder build`.

Answer

ansible-navigator.yml

Answer

Containerfile

Answer

requirements.yml

Question 15

An Ansible playbook uses the 'block' and 'rescue' directives. Which two statements are true about this construct? (Choose two.)

Accepted Answer

A rescue section executes only if the block tasks fail.. The 'rescue' section in an Ansible block is specifically designed to execute only when a task within the 'block' fails. This allows you to define error recovery or rollback steps that run only on hosts where the block encountered a failure, ensuring that successful hosts are not affected by rescue logic.

Answer

Rescue tasks are executed on all hosts in the play.

Answer

Blocks cannot be nested.

Answer

A block can have multiple rescue sections.

Question 16

Your organization uses Ansible Automation Platform 2.2 with private Automation Hub. You have developed a custom collection named 'my_company.network' that depends on 'cisco.ios' and 'vyos.vyos'. The collection is published in your private hub. You are building an execution environment using ansible-builder. The execution-environment.yml specifies 'EE_BASE_IMAGE: registry.redhat.io/ansible-automation-platform-22/ee-supported-rhel8:latest'. The dependencies section points to a requirements.yml file that includes your collection. When you run 'ansible-builder build', the build succeeds, but when running a playbook that uses modules from 'cisco.ios', you get an error 'module not found'. What is the most likely reason and the correct action to resolve it?

Accepted Answer

Add 'cisco.ios' to the requirements.yml file used during the execution environment build. The execution environment build process uses the requirements.yml file to determine which collections to include in the image. If the custom collection 'my_company.network' depends on 'cisco.ios', but that dependency is not explicitly listed in the requirements.yml, the builder will not include 'cisco.ios' in the execution environment. Adding 'cisco.ios' to the requirements.yml ensures it is installed during the build, making the module available at runtime.

Answer

Reinstall the collection on the controller node using 'ansible-galaxy collection install'

Answer

Use a different base image that includes 'cisco.ios'

Answer

Update the collection metadata to include dependencies and rebuild

Question 17

You are maintaining an Ansible automation for a large Red Hat Enterprise Linux deployment. The playbook configures NTP servers on all managed nodes. It uses a variable 'ntp_servers' defined in group_vars/all.yml as a list: ['0.rhel.pool.ntp.org', '1.rhel.pool.ntp.org', '2.rhel.pool.ntp.org']. The playbook task uses the 'uri' module to test connectivity to each server, but only if the server is reachable. The task currently uses:

```
- name: Test NTP server reachability
  uri:
    url: "http://{{ item }}:123"
    timeout: 5
  register: result
  loop: "{{ ntp_servers }}"
  until: result.status == 200
  retries: 3
  delay: 2
```

However, the playbook fails because the NTP servers do not respond to HTTP on port 123. You need to change the approach to test ICMP reachability using the 'ping' module, but the 'ping' module does not support a custom destination port. You also want to continue using a loop and register the success/failure per server. Which of the following is the best course of action?

Accepted Answer

Replace the task with the 'command' module to run 'ping -c 1 {{ item }}' and register results, using 'ignore_errors' to handle unreachable servers.. The 'ping' module in Ansible does not support custom ports or protocols, and NTP servers do not respond to HTTP on port 123. Using the 'command' module to run 'ping -c 1' allows ICMP reachability testing, and 'ignore_errors' prevents playbook failure when a server is unreachable, while still registering per-server success/failure via the loop.

Answer

Use the 'slurp' module to read the /etc/hosts file and check if the server is listed.

Answer

Use the 'wait_for' module with 'host={{ item }}' and 'port=123' to test connectivity, since NTP uses UDP 123.

Answer

Use the 'ping' module with a loop over the ntp_servers list, setting the 'data' parameter to the server IP.

Question 18

You are a Red Hat Certified Engineer tasked with creating a content collection for your organization. The collection will contain roles and modules used by multiple teams. The requirements are: (1) The collection must follow the Ansible community structure. (2) It must include a module that manages network devices. (3) The collection must be versioned and published to Automation Hub. (4) You must provide a minimal working example for other developers. After initial development, you run 'ansible-galaxy collection build' and it fails with 'ERROR! Unknown file type in collection: .gitkeep'. The collection directory contains:

- galaxy.yml
- plugins/modules/network_config.py
- roles/network/
- tests/
- .gitkeep (in tests/)

What single action should you take to resolve the build error?

Accepted Answer

Remove the .gitkeep file from the collection.. The `ansible-galaxy collection build` command fails because it encounters a `.gitkeep` file inside the `tests/` directory, which is not a recognized file type for Ansible collections. The correct action is to remove the `.gitkeep` file, as Ansible collections only allow specific file types (e.g., `.yml`, `.yaml`, `.py`, `.rst`, `.md`, `.txt`, `.cfg`, `.json`, `.j2`, `.ps1`, `.psm1`, `.psd1`, `.csv`, `.env`, `.gitignore`, `.galaxy_ignore.yml`, and a few others). The `.gitkeep` file is not in this allowed list, causing the build to abort.

Answer

Add a 'namespace' field to galaxy.yml.

Answer

Create a .galaxy_ignore.yml file to exclude .gitkeep.

Answer

Move the network_config.py module to a subdirectory named 'modules'.

Question 19

Which THREE considerations are important when designing a credential strategy in Ansible Automation Platform? (Choose exactly three.)

Accepted Answer

Credentials should be assigned to job templates rather than embedded in playbooks. Ansible Automation Platform (AAP) best practices dictate that credentials should be assigned to job templates, not embedded in playbooks. This decouples sensitive authentication data from automation logic, allowing credentials to be managed, rotated, and audited centrally through the AAP controller without exposing them in version-controlled playbook files.

Answer

All credentials must be stored within the AAP database for security

Answer

Playbooks should contain hardcoded credentials for simplicity

Question 20

The playbook above fails with 'template source file not found' for the copy task. Which change should be made to fix it?

Accepted Answer

Use the 'template' module instead of 'copy' for .j2 files.. The 'copy' module does not render Jinja2 templates; it simply copies files as is. When using a .j2 file with the copy module, Ansible expects the source file to exist literally, but it looks for the template in the wrong location, causing the 'template source file not found' error. The 'template' module is designed to process .j2 files, applying variables and Jinja2 logic, and then copying the result to the remote host. Therefore, replacing 'copy' with 'template' resolves the issue.

Answer

Add 'delegate_to: localhost' to copy the file from the control node.

Answer

Set 'backup: no' because backup creates additional files.

Answer

Set 'gather_facts: yes' to allow Ansible to locate the template.