EX294 Practice Test 5 — 25 Questions

Question 1

An admin wants to build an execution environment using ansible-builder. Which file is required to define the base image and additional Python dependencies?

Accepted Answer

execution-environment.yml. `execution-environment.yml` is the required file for `ansible-builder` to define the base image (via the `base_image` field) and additional Python dependencies (via the `python` section under `dependencies`). This YAML file serves as the build definition that `ansible-builder` reads to construct the container image, making it essential for creating custom execution environments.

Answer

requirements.yml

Answer

galaxy.yml

Answer

Dockerfile

Question 2

What is the output of the following playbook task?
```yaml
- name: Example task
  debug:
    msg: "{{ ['apple', 'banana'] | map('upper') | first }}"
```

Accepted Answer

'APPLE'. The playbook task likely uses a filter that extracts only the first element after applying `map('upper')`. For example, `{{ ['apple', 'banana'] | map('upper') | first }}` would output 'APPLE'. The `map` filter applies the `upper` filter to each element, but the `first` filter selects only the first item, resulting in the string 'APPLE'. Candidates may mistakenly think the entire list is returned, but this task explicitly retrieves a single element.

Answer

An error because map expects a list of strings.

Answer

['APPLE', 'BANANA']

Answer

'apple'

Question 3

Which ansible.cfg setting controls the number of parallel forks for task execution?

Accepted Answer

forks. The `forks` setting in `ansible.cfg` (or the `ANSIBLE_FORKS` environment variable) controls the maximum number of parallel processes Ansible uses when executing tasks on remote hosts. By default, this value is 5, meaning Ansible will manage up to 5 hosts concurrently per playbook run. Increasing this value allows Ansible to operate on more hosts simultaneously, improving throughput in larger environments.

Answer

parallel

Answer

max_parallel

Answer

threads

Question 4

Which TWO statements are true about Ansible content collections?

Accepted Answer

Collections can be installed from Automation Hub, Galaxy, or a Git repository.. Option A is correct because Ansible collections can be installed from multiple sources, including Automation Hub (Red Hat's certified content repository), Ansible Galaxy (the public community hub), and directly from a Git repository using ansible-galaxy collection install with a git URL or a requirements.yml entry specifying type: git. Option E is correct because Fully Qualified Collection Names (FQCN), such as ansible.builtin.copy or community.general.ufw, namespace each module, role, and plugin under its collection, preventing collisions when different collections define content with the same short name. Option B is wrong because collections may contain playbooks in their playbooks/ directory alongside roles, modules, and plugins. Option C is wrong because a role inside a collection must be referenced with its FQCN (for example, my_namespace.my_collection.my_role) or via the collections keyword in a playbook, not by its bare short name. Option D is wrong because execution environments are an optional containerized packaging mechanism for dependencies, not a prerequisite for using collections.

Answer

Collections cannot contain playbooks.

Answer

A role stored in a collection can be referenced by its short name without the collection prefix.

Answer

Execution environments are required to use collections.

Question 5

An Ansible role uses a variable "server_list" which is a list of dictionaries. Each dictionary has a key "ports" which should be a list of integers. However, due to inconsistent input, "ports" could be a comma-separated string (e.g., "80,443") or already a list of integers (e.g., [80,443]). The engineer wants to normalize "ports" to always be a list of integers for further processing. Which of the following tasks correctly normalizes the "ports" field?

Accepted Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': (item.ports is string) | ternary(item.ports | split(','), item.ports)}) }}"
  loop: "{{ server_list }}". It uses the `ternary` filter to check if `item.ports` is a string; if true, it splits the string by commas into a list, otherwise it keeps the existing list. This ensures the `ports` field is always normalized to a list of integers, handling both inconsistent input formats.

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports | split(',')}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': [item.ports] | flatten}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports}) }}"
  loop: "{{ server_list }}"

Question 6

Drag and drop the steps to configure SELinux to allow Apache to read a custom web directory in the correct order.

Accepted Answer

Create directory, set SELinux context, verify context, configure Apache, restart and test. SELinux for web: create dir, set context, verify, configure Apache, restart and test.

Answer

Create directory, configure Apache, set SELinux context, verify context, restart and test

Answer

Set SELinux context, create directory, verify context, configure Apache, restart and test

Answer

Create directory, verify context, set SELinux context, configure Apache, restart and test

Question 7

Match each Linux file system path to its typical content.

Accepted Answer

/etc: Configuration files for the system and applications. In Red Hat Enterprise Linux, standard directories follow the Filesystem Hierarchy Standard (FHS). /etc holds configuration files, /home stores user home directories, and /boot contains boot loader files and kernel images. Common confusions include mixing /var (variable data like logs) with /tmp (temporary files) and associating log files incorrectly with /tmp.

Answer

/var: Temporary files

Answer

/tmp: Log files

Question 8

A company uses Ansible to perform a rolling update of 10 web servers behind an HAProxy load balancer. The playbook uses the `serial` keyword and includes tasks to disable a host from the load balancer, update the web server package, and re-enable the host. Which TWO best practices should the administrator apply to minimize downtime and ensure a successful rolling update?

Accepted Answer

Set `serial: 1` to update one host at a time.. Setting `serial: 1` ensures that only one host is updated at a time, which is the safest way to perform a rolling update without overwhelming the load balancer or causing a service outage. This allows the playbook to complete the full update cycle (disable, update, re-enable) for each host before moving to the next, minimizing the number of hosts out of service simultaneously.

Answer

Use `any_errors_fatal: true` to stop the playbook if any host fails.

Answer

Use `throttle: 1` to limit the number of concurrent tasks across all hosts.

Answer

Use `async` and `poll` to run the update tasks in the background while proceeding to the next host immediately.

Question 9

A team is writing an Ansible role to configure a web server. They want to include default variables that can be easily overridden by playbook variables. Which directory and file should they use to define these variables?

Accepted Answer

defaults/main.yml. In Ansible roles, default variables are defined in the `defaults/main.yml` file. These variables have the lowest precedence, meaning they can be easily overridden by playbook variables, inventory variables, or any other variable source with higher precedence. This design allows role authors to provide sensible defaults while giving users the flexibility to customize behavior without modifying the role itself.

Answer

vars/defaults.yml

Answer

default_vars/main.yml

Answer

vars/main.yml

Question 10

Which THREE considerations are important when designing a credential strategy in Ansible Automation Platform? (Choose exactly three.)

Accepted Answer

Credentials should be assigned to job templates rather than embedded in playbooks. Ansible Automation Platform (AAP) best practices dictate that credentials should be assigned to job templates, not embedded in playbooks. This decouples sensitive authentication data from automation logic, allowing credentials to be managed, rotated, and audited centrally through the AAP controller without exposing them in version-controlled playbook files.

Answer

All credentials must be stored within the AAP database for security

Answer

Playbooks should contain hardcoded credentials for simplicity

Question 11

Which three of the following are valid methods to pass variables to an Ansible playbook at runtime? (Choose three.)

Accepted Answer

Using '--extra-vars' command line option.. The `--extra-vars` (or `-e`) command-line option allows you to pass variables directly to an Ansible playbook at runtime. This overrides any previously defined variables and can accept key=value pairs or load from JSON/YAML files, making it the primary method for runtime variable injection.

Answer

Using '--ask-vault-pass' and storing variables in encrypted files.

Answer

Using 'environment' directive in the playbook.

Question 12

Which THREE features are provided by Ansible's filter plugins? (Select exactly three.)

Accepted Answer

Data transformation (e.g., format dates, modify strings). Filter plugins in Ansible are used to transform data within Jinja2 templates. Option B is correct because filters like `| date`, `| regex_replace`, and `| upper` directly perform data transformation tasks such as formatting dates and modifying strings, which is a core purpose of filter plugins.

Answer

Defining new Ansible modules

Answer

Fetching data from external APIs

Question 13

Which TWO filters are commonly used to transform strings in Ansible? (Select exactly two.)

Accepted Answer

regex_replace. `regex_replace` is a built-in Jinja2 filter in Ansible that allows you to transform strings by replacing substrings that match a regular expression pattern. This is commonly used for string manipulation tasks such as sanitizing user input or formatting output.

Answer

items2dict

Answer

flatten

Answer

dict2items

Question 14

Which THREE components are typically included in an execution environment?

Accepted Answer

Base OS image. An execution environment is a container image that bundles everything needed to run Ansible automation, so option A (Base OS image) is correct because the container must be built on a base operating system layer such as a UBI or Debian image. Option C (Ansible Core and collections) is correct because the execution environment packages ansible-core together with the required collections so playbooks and roles have their modules and plugins available. Option D (Python interpreter and dependencies) is correct because Ansible runs on Python, and the environment must include the Python interpreter plus any Python libraries the modules and collections depend on. Option B (Ansible Navigator) is not included; it is a separate command-line tool used to build, run, and inspect execution environments, not a component inside them. Option E (Ansible Tower/AWX) is not included either, since AWX and Tower are automation controller platforms that consume execution environments rather than being packaged within one.

Answer

Ansible Navigator

Answer

Ansible Tower/AWX

Question 15

An administrator is debugging a playbook that uses multiple roles and wants to limit execution to a specific set of tasks. Which three methods can be used to filter task execution? (Choose three.)

Accepted Answer

Use the '--tags' command-line option.. Option A is correct because the '--tags' command-line option filters execution so that only tasks (and roles) tagged with the specified tag names are run, which directly limits a playbook to a specific set of tasks. Option B is correct because '--skip-tags' performs the inverse filtering, excluding tasks carrying the given tags while running everything else, another valid way to narrow execution. Option E is correct because '--start-at-task' begins execution at the first task whose name matches the given value, effectively limiting the run to that task and those following it. Option C is not a filtering method: '--check' runs the playbook in dry-run/check mode, reporting changes without applying them. Option D is also not a filter: '--step' prompts interactively before each task, allowing the operator to confirm or skip tasks one at a time rather than selecting a task set.

Answer

Use the '--check' command-line option.

Answer

Use the '--step' command-line option.

Question 16

A junior admin wants to remove a credential from Ansible Tower. Which role-based access control permission is required to delete a credential?

Accepted Answer

Admin. In Ansible Tower, the Admin role is the only role that grants full management permissions, including the ability to delete credentials. Lower-level roles like Read, Use, and Execute only allow viewing or using credentials, not modifying or deleting them. This aligns with Tower's RBAC hierarchy where Admin is required for destructive actions on any resource.

Answer

Read

Answer

Use

Answer

Execute

Question 17

An organization's execution environment must include a custom RPM that is not in the default base image. How should this be added in the execution-environment.yml?

Accepted Answer

Add the RPM to the 'dependencies' section under 'system'.. In an execution-environment.yml file, custom RPM packages that are not part of the default base image must be listed under the 'dependencies' section with the 'system' key. This instructs ansible-builder to install those RPMs using the system package manager (e.g., dnf or yum) during the build process, ensuring the execution environment includes the required system-level libraries or tools.

Answer

Add the RPM to the 'dependencies' section under 'python'.

Answer

Use a 'prepended_base' directive.

Answer

Use a custom base image that includes the RPM.

Question 18

An Ansible playbook includes a role that defines default variables in 'defaults/main.yml' and role variables in 'vars/main.yml'. A playbook sets the same variable in the play's 'vars' section. Which variable value takes precedence?

Accepted Answer

Play vars. In Ansible, variable precedence is hierarchical, and play vars (set directly in the play's `vars` section) have a higher priority than role defaults and role vars. Specifically, play vars override role vars, which in turn override role defaults. Therefore, when the same variable is defined in all three locations, the play vars value takes precedence.

Answer

Role defaults

Answer

Inventory group vars

Answer

Role vars

Question 19

A company wants to implement a rolling update for a stateful application where hosts cannot be updated in parallel due to data consistency. They also need to ensure that if any host fails, the entire update is rolled back. Which strategy meets these requirements?

Accepted Answer

Use serial: 1 and any_errors_fatal: yes. Setting `serial: 1` ensures hosts are updated one at a time, preventing parallel updates that could break data consistency for a stateful application. Adding `any_errors_fatal: yes` causes the entire playbook run to abort immediately if any host fails, which satisfies the requirement for a full rollback on failure.

Answer

Use serial: 2 and any_errors_fatal: yes

Answer

Use serial: 1 and ignore_errors: yes

Answer

Use serial: 0 and max_fail_percentage: 0

Question 20

An organization needs to implement security best practices for Ansible automation. Which three measures should be taken? (Choose three.)

Accepted Answer

Use ansible-vault to encrypt sensitive variables. Option A is correct because ansible-vault encrypts sensitive variables and files (e.g., via `ansible-vault encrypt` or `encrypt_string`) so secrets such as passwords and API keys are not exposed in plain text within playbooks or repositories. Option C is correct because regularly rotating Ansible Vault passwords limits the impact of a compromised vault password and should be paired with `ansible-vault rekey` to re-encrypt vaulted content under the new password. Option E is correct because limiting access to the automation controller with role-based access control (RBAC) enforces least privilege, ensuring only authorized users or teams can launch jobs, edit credentials, or manage inventories. Option B is not acceptable since storing secrets in plain text in a repository exposes them to anyone with repo access and violates security best practices. Option D is wrong because disabling SSH host key checking globally removes protection against man-in-the-middle attacks and should not be done as a security measure.

Answer

Store all secrets in plain text in repository

Answer

Disable SSH host key checking globally