EX294 Practice Test 26 — 15 Questions

Question 1

An administrator is migrating playbooks to use execution environments in automation controller. They want to ensure that all playbook runs use a custom execution environment that includes the necessary Python libraries and is signed to comply with security policy. What should the administrator do?

Accepted Answer

Build the execution environment using ansible-builder and then push it to a private registry and reference it in the automation controller.. Option A is correct because the administrator must build a custom execution environment using `ansible-builder`, which packages the required Python libraries and Ansible content into a container image. This image must then be pushed to a private registry (e.g., Quay.io or Red Hat Registry) and referenced in automation controller's execution environment configuration. Additionally, signing the image (e.g., via Podman or Skopeo) ensures compliance with security policies by verifying image integrity before execution.

Answer

Push the custom execution environment to the default namespace and assign it to job templates.

Answer

Use the default execution environment and install Python libraries via the playbook.

Answer

Define the execution environment in the project repository and use a pre-run hook.

Question 2

Which THREE actions are required to successfully publish a collection to Automation Hub?

Accepted Answer

Build the collection with ansible-galaxy collection build.. Option A is correct because `ansible-galaxy collection build` is the required command to package a collection into a distributable tarball (e.g., `namespace-collection-1.0.0.tar.gz`). This tarball is the artifact that is then uploaded to Automation Hub. Without building the collection, there is no file to publish.

Answer

Sign the collection with GPG.

Answer

Run ansible-galaxy collection test.

Question 3

An automation controller administrator needs to limit access to a sensitive inventory. Which two methods can be used to restrict access to that inventory? (Choose two.)

Accepted Answer

Place the inventory in an organization and assign appropriate roles to users and teams.. In Ansible Automation Platform, access to inventories is managed through Role-Based Access Control (RBAC) within organizations. Placing the inventory in an organization allows administrators to assign specific roles (e.g., Admin, Execute, Read) to users or teams, effectively restricting access. Additionally, using a custom role with read-only permissions ensures that users can view the inventory but cannot modify or delete it, providing a fine-grained access control mechanism.

Answer

Assign the 'admin' role to the inventory and grant it only to specific users.

Answer

Encrypt the inventory with ansible-vault and share the vault password only with authorized users.

Answer

Set the inventory to 'private' in the inventory settings.

Question 4

An organization uses automation controller with multiple projects and teams. They want to enforce that only the operations team can run job templates that make changes in production, while the development team can only run job templates that deploy to development environments. Which three components should be configured to achieve this? (Choose three.)

Accepted Answer

Assign different credentials to each job template.. Option A is correct because credentials in automation controller (formerly Ansible Tower/AWX) define the authentication context for a job template. By assigning different credentials (e.g., SSH keys or cloud API tokens) to production and development job templates, you can enforce that only the operations team's credentials have access to production infrastructure, while the development team's credentials are restricted to development environments. This is a fundamental access control mechanism that ties authentication directly to job execution.

Answer

Set execution environments to be team-specific.

Answer

Use a workflow template that routes based on user role.

Question 5

A team wants to use a certified collection from Red Hat Automation Hub but cannot access it directly due to firewall restrictions. What is the best practice?

Accepted Answer

Set up a private Automation Hub and sync the collection.. Option B is correct because setting up a private Automation Hub and syncing the certified collection is the best practice for environments with firewall restrictions. This approach ensures that the collection remains in a trusted, curated state, is automatically updated, and can be consumed by all team members via `ansible-galaxy` without manual intervention, maintaining compliance with Red Hat's support policies.

Answer

Download the collection manually and install from a tarball.

Answer

Copy the collection from another team's workspace.

Answer

Use ansible-galaxy collection install with --offline flag.

Question 6

Which file is required to define the content of an Ansible execution environment when using ansible-builder?

Accepted Answer

execution-environment.yml. The `execution-environment.yml` file is the required definition file for `ansible-builder` because it specifies the base image, custom dependencies (Python, system, or collections), and additional build instructions needed to construct a containerized Ansible execution environment. Without this file, `ansible-builder` has no manifest to process, as it is the sole input that defines the environment's content.

Answer

Dockerfile

Answer

requirements.yml

Answer

ansible.cfg

Question 7

Ansible Builder fails during the build of an execution environment with error: 'No matching manifest for linux/amd64 in the manifest list entries'. What is the most likely cause?

Accepted Answer

The base image specified is incompatible with the host architecture.. Option D is correct because the error 'No matching manifest for linux/amd64 in the manifest list entries' indicates that the base image specified in the execution environment definition file does not have a container image manifest for the host's CPU architecture (linux/amd64). Ansible Builder pulls the base image from a registry, and if that image only supports other architectures (e.g., linux/arm64), the build fails. This is a common issue when using a base image built for a different platform.

Answer

The ansible-builder version is too old.

Answer

The definition file has invalid syntax.

Answer

The container registry requires authentication.

Question 8

Which directory is the default location for installed Ansible collections on a control node for a regular user?

Accepted Answer

~/.ansible/collections. For a regular (non-root) user on an Ansible control node, the default location for installed collections is `~/.ansible/collections`. This is defined by Ansible's default collection search path, which includes the user's home directory under `~/.ansible/collections` for user-level installations. When a user runs `ansible-galaxy collection install` without specifying a custom path, the collection is placed in this directory by default.

Answer

/usr/share/ansible/collections

Answer

/etc/ansible/collections

Answer

/opt/ansible/collections

Question 9

A collection version is already published on Automation Hub. The developer needs to update the collection with a new feature. What must be done to the version number before publishing again?

Accepted Answer

Increment the patch or minor version number.. Option B is correct because Automation Hub enforces immutable collection versions; once a version is published, it cannot be overwritten or deleted. To publish a new feature, you must increment the patch (e.g., 1.0.0 → 1.0.1) or minor (e.g., 1.0.0 → 1.1.0) version number in the galaxy.yml file, following semantic versioning (semver) as required by Ansible collections.

Answer

No change needed; Automation Hub overwrites.

Answer

Increment the major version number.

Answer

Change the version to a pre-release identifier.

Question 10

An organization uses a private Git repository to store Ansible content collections. They want to automate the building of execution environments that include these collections. Which approach is recommended?

Accepted Answer

Build the collection manually, publish it to a private Automation Hub, then reference it in the EE.. Option D is correct because the recommended workflow for including private collections in an execution environment is to build the collection, publish it to a private Automation Hub, and then reference it in the `execution-environment.yml` file. This ensures the collection is available as a signed, versioned artifact that `ansible-builder` can pull during the build process, maintaining integrity and reproducibility without exposing Git credentials or requiring network access during build.

Answer

Store the collection tarball in a Git LFS and use an ADD command in the base image.

Answer

Add the Git repository as a source in the execution-environment.yml using the 'git' type.

Answer

Use ansible-builder to clone the repository during build with a pre-build script.

Question 11

Which command publishes a collection to Automation Hub?

Accepted Answer

ansible-galaxy collection publish ./namespace-name-1.0.0.tar.gz --token MYTOKEN. Option D is correct because `ansible-galaxy collection publish` is the specific command used to upload a collection tarball to Automation Hub (or any Galaxy server). The `--token` flag provides the required API authentication token for the publish operation. This command sends the tarball to the server's API endpoint, which validates and imports the collection.

Answer

ansible-galaxy collection import ./namespace-name-1.0.0.tar.gz

Answer

ansible-galaxy collection upload ./namespace-name-1.0.0.tar.gz

Answer

ansible-galaxy collection push ./namespace-name-1.0.0.tar.gz

Question 12

A developer is building an execution environment using `ansible-builder` and encounters the error: 'Error: Failed to pull base image: manifest for registry.redhat.io/ansible-automation-platform/ansible-builder-rhel8:2.0.0 not found: manifest unknown.' The developer checks the registry and verifies that the image exists with a different tag. Which action should the developer take to resolve the issue?

Accepted Answer

Change the tag in `execution-environment.yml` to a valid tag, such as 'latest'.. Option A is correct because the error indicates the specified tag '2.0.0' does not exist in the registry. The developer confirmed the image exists with a different tag, so updating the tag in `execution-environment.yml` to a valid one, such as 'latest', resolves the manifest lookup failure. `ansible-builder` uses this file to define the base image and tag for building the execution environment.

Answer

Run `podman login registry.redhat.io` to authenticate.

Answer

Modify the `execution-environment.yml` to use a different base image from Docker Hub.

Answer

Update the container runtime to the latest version.

Question 13

An organization's execution environment must include a custom RPM that is not in the default base image. How should this be added in the execution-environment.yml?

Accepted Answer

Add the RPM to the 'dependencies' section under 'system'.. In an execution-environment.yml file, custom RPM packages that are not part of the default base image must be listed under the 'dependencies' section with the 'system' key. This instructs ansible-builder to install those RPMs using the system package manager (e.g., dnf or yum) during the build process, ensuring the execution environment includes the required system-level libraries or tools.

Answer

Add the RPM to the 'dependencies' section under 'python'.

Answer

Use a 'prepended_base' directive.

Answer

Use a custom base image that includes the RPM.

Question 14

A team uses `ansible-navigator` to run playbooks with an execution environment. The playbook requires a collection that is not included in the execution environment. Which approach allows the team to use the collection without rebuilding the execution environment?

Accepted Answer

Set the `ANSIBLE_COLLECTIONS_PATHS` environment variable to a directory containing the collection and use `--execution-environment-image` with the EE.. Option A is correct because setting the `ANSIBLE_COLLECTIONS_PATHS` environment variable tells `ansible-navigator` to look for collections in a specified directory on the host, and using `--execution-environment-image` ensures the correct execution environment image is used. This allows the team to inject a collection into the container at runtime without modifying the execution environment image itself, as `ansible-navigator` mounts the specified host directory into the container automatically.

Answer

Use the `--container-options` flag to mount a volume with the collection.

Answer

Use `ansible-galaxy collection install` inside the execution environment at runtime.

Answer

Rebuild the execution environment with the collection included.

Question 15

An execution environment fails to start because the container image is missing the ansible-runner package. Which step in the build process should have included it?

Accepted Answer

The base image selection in execution-environment.yml. Option B is correct because the base image specified in the `execution-environment.yml` file determines the foundational operating system and packages for the execution environment. If the base image lacks `ansible-runner`, the environment will fail to start, as `ansible-runner` is essential for orchestrating playbook execution. The base image selection is the first step in the build process where this dependency must be satisfied.

Answer

The ansible-runner role in the builder definition

Answer

The requirement to install ansible-runner via pip in the containerfile

Answer

The additional_dependencies section in execution-environment.yml