EX294 Practice Test 26 — 15 Questions

Question 1

An Ansible playbook fails intermittently due to a service not starting in time. The administrator wants to configure a task to retry until the service confirms it is running. Which Ansible feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Until loop with retries and delay.. The 'until' loop in Ansible repeatedly retries a task until a specified condition evaluates to true, and it can be combined with 'retries' and 'delay' to control how many attempts are made and how long to wait between them. This is the idiomatic way to handle a service that takes time to start, such as waiting for a port to open or a status command to succeed. It directly addresses intermittent timing failures without failing the playbook prematurely.

Answer

Failed_when with conditional retry.

Answer

Block and rescue to catch failure.

Answer

Async with poll interval.

Question 2

An Ansible playbook uses the `ansible_password` variable to connect to a Windows host. The value is stored in an encrypted Ansible Vault file. Which credential type in Automation Controller would allow the vault password to be supplied at runtime?

Accepted Answer

Vault credential. Automation Controller's Vault credential type is specifically designed to provide the vault password needed to decrypt Ansible Vault-encrypted variables like `ansible_password`. When a job runs, the controller uses this credential to unlock the vault file, allowing the playbook to access the encrypted value at runtime without exposing the plaintext password.

Answer

Cloud credential

Answer

Machine credential

Answer

Network credential

Question 3

What is the purpose of the 'meta: flush_handlers' task?

Accepted Answer

Force handlers to run immediately. The 'meta: flush_handlers' task in Ansible is used to force any pending handler notifications to run immediately at that point in the play, rather than waiting until the end of the play. This is correct because it ensures that handlers triggered by earlier tasks execute right away, which is essential when subsequent tasks depend on the state changes those handlers make (e.g., restarting a service before configuring it further).

Answer

Restart services immediately

Answer

Clear the handler queue

Answer

Wait for handlers to complete

Question 4

An Ansible playbook uses 'become: yes' to install packages. The playbook works when run manually by the administrator but fails when run from automation controller with 'Missing sudo password'. The administrator has configured a machine credential with the SSH key and the 'Become password' field is blank. What is the most likely issue?

Accepted Answer

The machine credential does not include the become password.. The playbook uses 'become: yes' to escalate privileges, which requires a become password when the remote user's sudo configuration demands password authentication. Since the machine credential's 'Become password' field is blank, Automation Controller cannot supply the password during the privilege escalation step, causing the 'Missing sudo password' error. The administrator's manual run succeeds because the SSH session can prompt interactively for the password, but Automation Controller's non-interactive execution requires the password to be pre-configured in the credential.

Answer

The become method is set to 'su' instead of 'sudo'.

Answer

The remote user is not in the sudoers file.

Answer

The SSH private key is not loaded into the automation controller.

Question 5

After rotating the Ansible Vault password in the automation controller, several job templates that use vault credentials start failing with 'decryption failed'. The vault credential has been updated with the new password. What is the most likely cause of the failure?

Accepted Answer

The vault file in the project repository still uses the old vault password and needs to be re-encrypted with the new password.. The vault file itself is encrypted with a specific password. When the vault password is rotated in the automation controller, the vault file stored in the project repository is still encrypted with the old password. The job template uses the vault credential to decrypt the file, but since the credential now holds the new password, decryption fails. The vault file must be re-encrypted with the new password using `ansible-vault rekey` or by decrypting and re-encrypting it.

Answer

The automation controller needs a restart to apply the new vault credential.

Answer

The vault credential is not linked to the job template correctly.

Answer

The vault credential type requires the old password to be stored separately.

Question 6

An admin attempts to run this playbook as a job template in AAP. The job fails with 'ERROR! 'now' is not a valid attribute for a task'. What is the issue?

Accepted Answer

The 'now' attribute does not exist; it may be a typo for 'notify' or should be removed.. The error message 'ERROR! 'now' is not a valid attribute for a task' indicates that Ansible does not recognize 'now' as a valid task attribute. The 'now' keyword is not a standard Ansible directive; it is likely a typo for 'notify' (used with handlers) or should be removed entirely. Ansible validates task attributes against a strict schema, and any unknown attribute causes a parsing failure.

Answer

The template task is missing quotes around the file paths.

Answer

The playbook has an incorrect indentation in the tasks block.

Answer

The 'become' directive is placed incorrectly at the play level.

Question 7

Which file is required to define the content of an Ansible execution environment when using ansible-builder?

Accepted Answer

execution-environment.yml. The `execution-environment.yml` file is the required definition file for `ansible-builder` because it specifies the base image, custom dependencies (Python, system, or collections), and additional build instructions needed to construct a containerized Ansible execution environment. Without this file, `ansible-builder` has no manifest to process, as it is the sole input that defines the environment's content.

Answer

Dockerfile

Answer

requirements.yml

Answer

ansible.cfg

Question 8

A playbook reads a YAML file containing a list of dictionaries named `packages`, where each dictionary has keys `name`, `version`, and `enabled`. You need to produce a comma-separated string of only the `name` values for all entries where `enabled` is true. Which Jinja2 expression accomplishes this in a single task variable assignment?

Accepted Answer

{{ packages | selectattr('enabled') | map(attribute='name') | join(',') }}. Filtering a list of dictionaries by a boolean attribute and then extracting a specific key is a common data transformation. The `selectattr` filter is designed to filter by attribute, `map(attribute=...)` extracts the desired key, and `join` combines the results into a string. The order of operations is critical: filter first, then map, then join.

Answer

Answer

{{ packages | select('enabled') | map(attribute='name') | join(',') }}

Answer

{{ packages | map(attribute='name') | selectattr('enabled') | join(',') }}

Question 9

An administrator needs to connect to a set of servers that use different SSH users: 'admin' for the 'web' group and 'deploy' for the 'db' group. The inventory file contains these groups. The administrator wants to avoid specifying the user in the playbook and wants the correct user to be used automatically for each group. Which method should be used?

Accepted Answer

Set ansible_user in the [web:vars] and [db:vars] sections of the inventory file.. Setting ansible_user in [group:vars] sections of the inventory file assigns the correct SSH user to all hosts in each group. This is a standard inventory feature that automatically applies group-specific connection variables. It requires no playbook modifications and ensures the right user is used for web and db hosts without manual per-host configuration.

Answer

Set the remote_user directive in the playbook and use a variable that changes per group.

Answer

Define ansible_user in host_vars for each host individually, using the correct user for that host's group.

Answer

Use the --user command-line option with a comma-separated list of users for each group.

Question 10

An administrator uses an inventory file with a group 'web' and a host 'web1' that also belongs to group 'db'. The group_vars/web.yml file sets 'http_port: 80', and group_vars/db.yml sets 'http_port: 3306'. The playbook uses 'http_port' to configure a service. What will be the value of http_port for web1 when the playbook runs?

Accepted Answer

80, because group_vars/web.yml takes precedence over group_vars/db.yml for hosts in both groups.. When a host belongs to multiple groups, Ansible merges group variables by processing groups in alphabetical order. Later groups override earlier ones. 'db' precedes 'web' alphabetically, so variables from group_vars/web.yml override those from group_vars/db.yml. Thus http_port becomes 80. Inventory file order and duplicate definitions do not cause errors; precedence rules apply.

Answer

3306, because the 'db' group is alphabetically before 'web'.

Answer

The playbook will fail with an error because http_port is defined in two groups.

Answer

80, because the 'web' group appears first in the inventory file.

Question 11

A playbook registers the output of the `package_facts` module and must build a list containing only the version strings of installed packages whose name begins with 'httpd'. Which filter pipeline extracts those versions?

Accepted Answer

ansible_facts.packages | dict2items | selectattr('key', 'match', '^httpd') | map(attribute='value') | flatten | map(attribute='version') | list. Package facts are stored as a dictionary keyed by package name, with each value being a list of records. Extracting versions therefore requires converting the mapping to items, filtering keys, unwrapping the value lists with flatten, and then mapping the version attribute. Pipelines that skip the flatten step or that treat the dictionary as a list of objects cannot reach the nested version field.

Answer

ansible_facts.packages | dict2items | selectattr('key', 'match', '^httpd') | map(attribute='value.version') | list

Answer

ansible_facts.packages | selectattr('name', 'match', '^httpd') | map(attribute='version') | list

Answer

ansible_facts.packages | dict2items | selectattr('key', 'match', '^httpd') | map(attribute='value') | list

Question 12

A developer is preparing a collection for distribution and must declare its metadata, including version, license, and the list of collections it depends on. Which file at the collection root contains these declarations?

Accepted Answer

galaxy.yml. The manifest that describes a collection to Galaxy and to dependency resolution is `galaxy.yml`, which holds version, license, and the `dependencies` mapping. Runtime requirements live elsewhere, and consumer-side requirement files are unrelated to how the collection itself is described when packaged.

Answer

requirements.yml

Answer

meta/runtime.yml

Answer

plugins/README.md

Question 13

An engineer is preparing to build an execution environment using `ansible-builder`. The build must include several collections and also install additional Python packages. Which two files are used to declare these dependencies? (Choose two.)

Accepted Answer

requirements.yml. The correct files are `requirements.yml` for Ansible collections and roles, and `requirements.txt` for Python packages. These are referenced by the `execution-environment.yml` file and are used by `ansible-builder` to install the necessary dependencies into the execution environment.

Answer

galaxy.yml

Answer

execution-environment.yml

Answer

bindep.txt

Question 14

Your team stores two inventories: a static file at inventories/prod and a dynamic inventory plugin configuration at inventories/aws_ec2.yml. The static file defines the group `db` with `db1 ansible_host=172.16.5.10`, while the plugin also returns a host named db1 with the address 172.16.5.99. You run `ansible-inventory -i inventories/prod -i inventories/aws_ec2.yml --host db1`. Which host variable value does Ansible report for ansible_host?

Accepted Answer

172.16.5.99, because the last inventory source processed takes precedence for the same host.. Merging multiple inventories unifies hosts and groups rather than rejecting duplicates. For a host present in several sources, variables from the source processed later override those from earlier sources. Since the dynamic plugin is processed after the static file, its ansible_host value is the one that survives, so the host resolves to the plugin-provided address.

Answer

Both values are retained, and Ansible fails with a duplicate host variable error.

Answer

Neither value; Ansible reports the host as undefined because duplicate host names are skipped.

Answer

172.16.5.10, because the first inventory source listed on the command line takes precedence.

Question 15

An administrator is designing a rolling update playbook for a 20-node application cluster. The playbook must limit the blast radius of failures and allow the rollout to pause safely if too many hosts fail. Which two Ansible play-level keywords directly control how many hosts are updated at once and whether the play aborts based on failures? (Choose two.)

Accepted Answer

serial. serial controls how many hosts are processed in each rolling batch, directly limiting the blast radius. max_fail_percentage defines the failure threshold per batch that aborts the play, preventing the rollout from continuing when too many hosts fail. Together they provide the two controls the administrator needs for a safe rolling update.

Answer

forks

Answer

order

Answer

any_errors_fatal