EX294 Practice Test 26 — 15 Questions

Question 1

An Ansible playbook uses the 'deployment' resource with a 'rolling_update' strategy. Which module is typically used to manage this in a Kubernetes/OpenShift environment?

Accepted Answer

kubernetes.core.k8s. The `kubernetes.core.k8s` module is the correct choice because it directly manages Kubernetes/OpenShift resources, including Deployments, and supports rolling update strategies natively. It interacts with the Kubernetes API to apply declarative configurations, handling the rolling update logic (e.g., `maxSurge`, `maxUnavailable`) without requiring manual orchestration via shell commands or file copies.

Answer

ansible.builtin.copy

Answer

ansible.builtin.command

Answer

ansible.builtin.shell

Answer

ansible.builtin.service

Question 2

You are managing a rolling update of a 10-node web application cluster using Ansible. The application requires that at least 8 nodes remain available during the update to handle traffic. You have written a playbook that uses serial: 2 (updates 2 nodes at a time). During a test run, the playbook updates the first batch of 2 nodes successfully, but when it proceeds to the second batch, one of the nodes fails to restart the web service. However, the playbook continues and updates the remaining nodes. At the end, only 7 nodes are healthy, causing performance degradation. You need to ensure that if a batch fails to meet the minimum health requirements, the entire rollout is stopped and no further updates are applied. Which course of action should you take?

Accepted Answer

Use a rolling update strategy with serial: 2 and a post-task health check, and set max_fail_percentage to abort the play if the healthy node count drops below 8.. This approach uses `max_fail_percentage` at the play level to abort the playbook if a certain percentage of tasks fail. Combined with a post-task health check that fails when fewer than 8 nodes are healthy, the playbook stops if the healthy node count drops below the required threshold, preventing further updates and performance degradation. The `serial: 2` ensures nodes are updated in batches, and the health check verifies the minimum healthy count after each batch.

Answer

Add a retry loop to the service restart task with a delay and count of 5.

Answer

Set ignore_errors: yes on the service restart task to avoid failures stopping the playbook.

Answer

Increase serial to 3 to complete the update faster and reduce the chance of node failures.

Question 3

Which TWO filters are commonly used to transform strings in Ansible? (Select exactly two.)

Accepted Answer

regex_replace. `regex_replace` is a built-in Jinja2 filter in Ansible that allows you to transform strings by replacing substrings that match a regular expression pattern. This is commonly used for string manipulation tasks such as sanitizing user input or formatting output.

Answer

items2dict

Answer

flatten

Answer

dict2items

Question 4

Which TWO methods can be used to limit the hosts that a job template runs against when launching a job? (Choose exactly two.)

Accepted Answer

Using the 'LIMIT' field in the job template or at launch time.. The 'LIMIT' field in Ansible Tower/AWX allows you to restrict the execution of a job template to a specific subset of hosts in the inventory, either by host name, group name, or pattern. This can be set in the job template definition or overridden at launch time, providing flexible targeting without modifying the inventory structure.

Answer

Assigning a specific credential to the job template.

Answer

Using the 'Tags' field to include only certain tasks.

Answer

Setting the 'Source Control Branch' in the project.

Question 5

What is the effect of the `filter_plugins` setting in `ansible.cfg`?

Accepted Answer

It adds the directory to the default search path for filter plugins.. The `filter_plugins` setting in `ansible.cfg` adds the specified directory to the default search path for filter plugins, not replacing it. Ansible searches default locations like `~/.ansible/plugins/filter` and the `filter_plugins` directory relative to the playbook, in addition to any directories specified by this setting. Therefore, option D is correct.

Answer

It sets the directory for filter plugins but only for the current playbook.

Answer

It configures the path for lookup plugins, not filter plugins.

Answer

It replaces the default search path for filter plugins with the specified directory.

Question 6

Which TWO of the following are valid methods to manage credentials in Ansible Tower?

Accepted Answer

Integrate with an external secrets management system using a credential lookup plugin.. Ansible Tower (now Red Hat Ansible Automation Platform) supports integration with external secrets management systems like HashiCorp Vault, CyberArk, or Azure Key Vault via credential lookup plugins. This allows Tower to retrieve secrets dynamically at runtime without storing them in the Tower database, aligning with security best practices.

Answer

Export credentials from the Ansible Tower API in plain-text.

Answer

Use machine credentials with an SSH key that has a passphrase.

Answer

Store credentials in plain-text in the Ansible Tower database.

Question 7

A playbook needs to load encrypted variables from a file vault.yml. The vault password is stored in a file vault-pass with restricted permissions. Which method securely loads the variables when running the playbook?

Accepted Answer

Run ansible-playbook playbook.yml --vault-password-file vault-pass. The `--vault-password-file` flag allows Ansible to read the vault password from a file with restricted permissions, enabling non-interactive decryption of `vault.yml` without exposing the password in the process list or requiring manual input. This method is secure when the vault password file has proper permissions (e.g., 600) and is stored in a controlled location.

Answer

Use include_vars: file: vault.yml without any additional configuration.

Answer

Run ansible-playbook with --ask-vault-pass to prompt for the password.

Answer

Set the environment variable ANSIBLE_VAULT_PASSWORD_FILE in the user's profile.

Question 8

A company uses Ansible Vault to encrypt sensitive data in playbooks. They have multiple environments (dev, test, prod) and use a separate vault password file for each environment. The passwords are stored in files named 'vault-pass-dev', 'vault-pass-test', and 'vault-pass-prod'. To run a playbook against the test environment, they use the command 'ansible-playbook site.yml -i test -e @test-vars.yml --vault-id test@vault-pass-test'. This runs successfully from the command line. However, when they define the same vault-id in an Ansible Tower credential and attempt to run the job, the job fails with 'ERROR! Decryption failed (no vault secrets would be found that could decrypt the vault encrypted file)' for a vault-encrypted variable file that was encrypted with a different vault ID (e.g., 'dev'). The team expects that Tower would use the provided vault credential to decrypt all vault-encrypted files. Which change should be made to ensure correct decryption in Tower?

Accepted Answer

Add multiple vault credentials to the job template, one for each vault ID used in the project.. In Ansible Tower, each vault credential is associated with a single vault ID. When a playbook uses multiple vault IDs (e.g., dev, test, prod), Tower must have a vault credential for each ID to decrypt files encrypted with that ID. By adding multiple vault credentials to the job template—one for each vault ID used in the project—Tower can automatically select the correct credential for decryption, resolving the failure. Option A is correct because it provides Tower with all necessary vault IDs. Option B is wrong because Tower does not support comma-separated passwords in a single credential. Option C would simplify but is not a configuration change. Option D is incorrect because the password file already contains the correct password for the test vault ID, but the encrypted file uses the dev vault ID.

Answer

Enter all vault passwords separated by commas in the 'VAULT PASSWORD' field of a single credential.

Answer

Re-encrypt all files with the same vault ID (e.g., 'default') to simplify the setup.

Answer

Change the vault password file to contain the password for the vault ID that was used to encrypt the file.

Question 9

A junior admin wants to remove a credential from Ansible Tower. Which role-based access control permission is required to delete a credential?

Accepted Answer

Admin. In Ansible Tower, the Admin role is the only role that grants full management permissions, including the ability to delete credentials. Lower-level roles like Read, Use, and Execute only allow viewing or using credentials, not modifying or deleting them. This aligns with Tower's RBAC hierarchy where Admin is required for destructive actions on any resource.

Answer

Read

Answer

Use

Answer

Execute

Question 10

A senior automation engineer is optimizing a playbook that processes large amounts of data. The playbook uses the "json_query" filter to filter and extract specific fields from a complex JSON structure returned by an API. The engineer notices that the playbook runs very slowly and consumes a lot of memory. They suspect the json_query filter is inefficient for this use case. The engineer wants to replace json_query with a combination of built-in Ansible filters to improve performance. The JSON structure is as follows:
{
  "servers": [
    {"name": "web01", "status": "active", "role": "web"},
    {"name": "web02", "status": "active", "role": "web"},
    {"name": "db01", "status": "active", "role": "db"}
  ]
}
The engineer needs to extract a list of server names where the status is "active" and the role is "web". The current code using json_query is:
server_names: "{{ api_result | json_query(\"servers[?status=='active' && role=='web'].name\") }}"
Which of the following alternatives uses only Ansible built-in filters (not json_query) and is likely to be more efficient?

Accepted Answer

server_names: "{{ api_result.servers | selectattr('status', '==', 'active') | selectattr('role', '==', 'web') | map(attribute='name') | list }}". It uses selectattr with '==' twice to filter servers where status equals 'active' and role equals 'web', then map to extract names. This approach uses only built-in Ansible filters and avoids JMESPath parsing, making it more efficient for large datasets. Option A uses rejectattr, which would exclude items that match the condition, thus returning the opposite set. Option B uses 'equalto', which is not a valid operator for selectattr. Option C uses 'is', which is also invalid.

Answer

server_names: "{{ api_result.servers | rejectattr('status', '==', 'active') | rejectattr('role', '==', 'web') | map(attribute='name') | list }}"

Answer

server_names: "{{ api_result.servers | selectattr('status', 'equalto', 'active') | selectattr('role', 'equalto', 'web') | map(attribute='name') | list }}"

Answer

server_names: "{{ api_result.servers | selectattr('status', 'is', 'active') | selectattr('role', 'is', 'web') | map(attribute='name') | list }}"

Question 11

Given a list of dictionaries `users` with keys `name` and `role`, a playbook needs to create a list of names where role is 'admin'. Which expression achieves this?

Accepted Answer

{{ users | selectattr('role', 'equalto', 'admin') | map(attribute='name') | list }}. It first uses `selectattr` to filter the list of dictionaries, keeping only those where `role` equals `'admin'`, then applies `map(attribute='name')` to extract the `name` values from the filtered dictionaries, and finally converts the result to a list with the `list` filter. This produces a list of names for admin users.

Answer

{{ users | map(attribute='name') | selectattr('role', 'equalto', 'admin') | list }}

Answer

{{ users | json_query("[?role=='admin'].{name: name}") }}

Answer

Question 12

Which THREE of the following are valid 'serial' values for an Ansible rolling update playbook?

Accepted Answer

serial: [1,2,3]. Options A, B, and C are all valid 'serial' values for an Ansible rolling update playbook. Ansible's 'serial' keyword controls how many hosts are updated at a time. It accepts an integer (e.g., 1), a percentage string without quotes (e.g., 50%), or a list of integers (e.g., [1,2,3]) to specify varying batch sizes sequentially. Option D is invalid because quoting the percentage (e.g., '25%') treats it as a YAML string that includes the quotes, which Ansible does not interpret correctly. Option E 'batch' is not a valid value.

Answer

serial: '25%'

Answer

serial: 'batch'

Question 13

An Ansible Automation Platform administrator is reviewing a job template that runs a playbook against a large inventory. To improve performance without sacrificing accuracy, which TWO strategies should be implemented? (Choose two.)

Accepted Answer

Implement the ansible-cmdb tool to generate a CMDB from gathered facts.. The ansible-cmdb tool generates a Configuration Management Database (CMDB) from gathered facts, which can be used for documentation and analysis without re-running fact gathering on every playbook execution. Option B is correct because enabling fact caching with a Redis backend stores gathered facts in a fast, external cache, allowing subsequent playbook runs to reuse cached facts instead of gathering them again from each host, which significantly reduces execution time for large inventories.

Answer

Use the serial keyword to limit concurrent execution to 1 host at a time.

Answer

Set forks to 50 in ansible.cfg to maximize parallel execution.

Answer

Set gathering = explicit in ansible.cfg to skip fact gathering.

Question 14

An Ansible playbook uses 'become: yes' to install packages. The playbook works when run manually by the administrator but fails when run from automation controller with 'Missing sudo password'. The administrator has configured a machine credential with the SSH key and the 'Become password' field is blank. What is the most likely issue?

Accepted Answer

The machine credential does not include the become password.. The playbook uses 'become: yes' to escalate privileges, which requires a become password when the remote user's sudo configuration demands password authentication. Since the machine credential's 'Become password' field is blank, Automation Controller cannot supply the password during the privilege escalation step, causing the 'Missing sudo password' error. The administrator's manual run succeeds because the SSH session can prompt interactively for the password, but Automation Controller's non-interactive execution requires the password to be pre-configured in the credential.

Answer

The become method is set to 'su' instead of 'sudo'.

Answer

The remote user is not in the sudoers file.

Answer

The SSH private key is not loaded into the automation controller.

Question 15

Which THREE of the following are valid Ansible lookup plugins? (Select exactly three.)

Accepted Answer

`csvfile`. `csvfile` is a built-in Ansible lookup plugin that reads data from CSV files, allowing playbooks to parse structured tabular data. It is documented in the official Ansible lookup plugin list and is commonly used for dynamic inventory or configuration values.

Answer

`map`

Answer

`select`