EX294 Practice Test 27 — 15 Questions

Question 1

A Red Hat Certified Engineer is managing an Ansible inventory that includes a mix of Linux and network devices. The network devices are running Cisco IOS and require the network_cli connection plugin. The engineer needs to specify the username and password for these devices in the inventory. Which inventory variables should be used to provide the credentials for the network devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ansible_user and ansible_password. The network_cli connection plugin relies on ansible_user and ansible_password for authentication. These variables are set in the inventory or group_vars and are used by the plugin to establish connections to network devices, ensuring proper credential management.

Answer

ansible_winrm_user and ansible_winrm_password

Answer

ansible_ssh_user and ansible_ssh_pass

Answer

ansible_network_user and ansible_network_password

Question 2

A platform team maintains an execution environment definition where `requirements.yml` lists several collections. They need to pin `community.general` to a specific version range so that only releases from 7.0.0 up to but not including 8.0.0 are installed during the build. Which syntax inside `requirements.yml` accomplishes this?

Accepted Answer

- name: community.general
  version: ">=7.0.0,<8.0.0". Ansible collection requirements use the `version` key with Python-style comparison operators. Combining a lower bound and an exclusive upper bound in a single quoted string yields the desired 7.x-only range, which is the only syntax among the choices that the resolver actually understands when building the execution environment.

Answer

- name: community.general
  version: "^7.0.0"

Answer

- name: community.general
  version_range: ">=7.0.0 <8.0.0"

Answer

- name: community.general
  version: "7.x"

Question 3

An administrator is installing Ansible Automation Platform 2.4 on a RHEL 9 server. They have extracted the installer tarball and are ready to run the setup script. Which command should they use to perform a standard installation using the default inventory?

Accepted Answer

`./setup.sh`. The AAP installer is executed by running the `setup.sh` script from the extracted directory. This script reads the `inventory` file and runs the necessary playbooks. Using any other command, such as `ansible-playbook` with a guessed playbook name or a nonexistent `install.sh`, will not perform the installation correctly.

Answer

`./install.sh`

Answer

`ansible-playbook -i inventory install.yml`

Answer

`ansible-playbook setup.yml`

Question 4

You are designing a rolling update playbook for a 20-node application cluster. The application requires that no more than 25% of the nodes be unavailable at any time. You want Ansible to automatically pause the play if the failure rate within a batch exceeds a threshold, so that you can investigate before continuing. Which play-level keyword should you use?

Accepted Answer

`max_fail_percentage`. The `max_fail_percentage` keyword is designed to abort a play when the failure rate within a batch exceeds a given percentage. By setting it to 25, Ansible will stop the rolling update if more than 25% of the hosts in a batch fail, matching the application's availability requirement. This provides an automatic safety check during the update.

Answer

`serial`

Answer

`any_errors_fatal`

Answer

`ignore_errors`

Question 5

You must store a database password that a playbook will use on managed nodes. Your security policy forbids clear-text secrets in the repository and requires that the secret remain usable with `ansible-playbook --vault-password-file /home/devops/.vault_pass`. Which two actions satisfy the policy? (Choose two.)

Accepted Answer

Create the secret with `ansible-vault encrypt_string --vault-password-file /home/devops/.vault_pass --name db_password` and paste the resulting block into the vars file.. Both accepted approaches produce artifacts encrypted with the same vault password that the required --vault-password-file supplies. Inline encryption with encrypt_string hides a single value inside an otherwise readable vars file, while encrypting an entire vars file protects a group of secrets referenced through vars_files. Each keeps clear-text secrets out of the repository while remaining fully usable at run time.

Answer

Reference the password with `lookup('env', 'DB_PASSWORD')` so it is read from the environment at run time.

Answer

Commit the password in a vars file and add the file path to a .gitignore entry in the repository root.

Answer

Define the password as an extra variable with `-e db_password=...` in the playbook invocation.

Question 6

An administrator is preparing to install Red Hat Ansible Automation Platform 2.5 using the containerized installer on a RHEL 9 host. The installer bundle has been extracted, and the administrator must provide the subscription manifest and other settings before running the setup playbook. Which file should the administrator edit to supply these installation parameters?

Accepted Answer

The inventory file in the installer's setup directory, which holds host and platform configuration variables.. The containerized installer is driven by an inventory file in its setup directory that holds both the target host definitions and the platform variables, including the subscription manifest location. Editing this file is the supported way to supply installation parameters before running the setup playbook.

Answer

The group_vars/all.yml file created automatically in /etc/awx after the bundle is extracted.

Answer

The ansible-navigator.yml file in the user's home directory, specifying execution environment options.

Answer

The /etc/ansible/ansible.cfg file on the target host, adding an [aap] section with the install variables.

Question 7

An administrator is deploying a redundant Ansible Automation Platform 2.4 cluster with two controller nodes and one database node. They want to ensure that the automation controller remains available if one controller node fails. Which configuration should they implement?

Accepted Answer

Configure the two controller nodes behind a load balancer that performs health checks on port 443.. High availability for the automation controller in AAP is achieved by deploying multiple controller nodes behind a load balancer that performs health checks. This ensures that if one node becomes unavailable, traffic is automatically routed to the remaining healthy node, minimizing downtime. Other options do not provide automatic failover for the controller service.

Answer

Deploy a single controller node with a hot standby that is manually activated during an outage.

Answer

Install the automation controller on both nodes and use a shared NFS mount for the project directory.

Answer

Set up database replication between the two controller nodes and configure automatic failover.

Question 8

An administrator needs to store sensitive credentials for a playbook that will be run from a control node. The credentials include an SSH password and a sudo password. The administrator wants to keep these encrypted at rest and avoid hardcoding them in the playbook. Which TWO methods are valid for providing these credentials securely? (Choose two.)

Accepted Answer

Store the passwords in the inventory file as host variables, and encrypt the inventory file with ansible-vault.. Ansible Vault is the primary tool for encrypting sensitive data at rest. Encrypting a vars file and including it with vars_files, or encrypting an inventory file that contains host variables, both securely provide passwords to playbooks. The vault password can be supplied separately. Command-line extra vars, debug printing, and environment variables either expose secrets or fail to encrypt them at rest, so they are not valid secure methods.

Answer

Define the passwords as extra variables using the -e option on the command line, like -e "ansible_password=secret".

Answer

Set the passwords as environment variables on the control node and reference them with lookup('env', 'SSH_PASSWORD') in the playbook.

Answer

Use the ansible.builtin.debug module to print the passwords from a vault-encrypted file, then manually copy them into the playbook.

Question 9

A template must emit a comma-separated string of hostnames from a list variable `web_nodes`, sorted alphabetically, for use in a configuration file. Which expression produces that string?

Accepted Answer

{{ web_nodes | sort | join(',') }}. The order of filters matters: sorting must happen while the data is still a list, then joining converts it to a string. Applying join before sort would sort characters, and filters like unique or flatten do not impose alphabetical order. Only sorting the list first and then joining with a comma delimiter meets the requirement.

Answer

Answer

Answer

Question 10

An automation engineer stores a sudo password inside a project variable file that is committed to Git. The team requires that the cleartext value never appears in the repository and that playbooks still consume the variable transparently. Which approach meets this requirement?

Accepted Answer

Encrypt the variable file with ansible-vault encrypt and reference it from the playbook with vars_files; commit the encrypted file to Git.. Ansible Vault encrypts files and individual values using AES-256 so that secrets can be safely stored in source control. Encrypting the whole variable file with ansible-vault encrypt and loading it through vars_files keeps the plaintext out of Git while playbooks still resolve the variable normally. Decryption happens at runtime using a vault password provided interactively or through a password file.

Answer

Run ansible-vault encrypt_string on the variable and store the resulting inline value directly in group_vars/all.yml.

Answer

Add the variable file to .gitignore and distribute it manually to each control node's home directory before running the playbook.

Answer

Store the password in an environment variable on the control node and reference it with lookup('env', 'SUDO_PASS') inside the playbook.

Question 11

An automation engineer is preparing an execution environment for a project that requires the `community.general` collection and the `netaddr` Python library. The engineer has created an `execution-environment.yml` file in the project directory. Which command should be used to build the execution environment image?

Accepted Answer

ansible-builder build --file execution-environment.yml. The `ansible-builder build` command is the correct tool to create an execution environment image from an `execution-environment.yml` definition. It parses the definition, installs collections and Python dependencies, and produces a container image. Other commands like `ansible-galaxy collection build` or `podman build` serve different purposes and do not automate the execution environment creation process.

Answer

ansible-galaxy collection build

Answer

ansible-navigator build execution-environment.yml

Answer

podman build -t my-ee:latest .

Question 12

An administrator is creating a new execution environment and wants to use a minimal base image provided by Red Hat that includes `ansible-core` and essential Python libraries. Which base image should be specified in the `execution-environment.yml` file?

Accepted Answer

`registry.redhat.io/ansible-automation-platform-23/ee-minimal-rhel8:latest`. Red Hat offers minimal execution environment base images specifically designed for Ansible Automation Platform. The `ee-minimal-rhel8` image includes `ansible-core` and required Python libraries, providing a supported and optimized foundation. Other images either lack Ansible components or are not minimal for this purpose. Using the Red Hat-provided minimal image simplifies the build and ensures compatibility.

Answer

`quay.io/ansible/ansible-runner:latest`

Answer

`registry.access.redhat.com/ubi8/ubi:latest`

Answer

`docker.io/library/python:3.9-slim`

Question 13

A playbook must retrieve a secret from an external vault service at runtime instead of storing it in the repository. The team wants the value available as a variable named db_password. Which Ansible feature should be used?

Accepted Answer

A lookup plugin such as community.hashi_vault.hashi_vault referenced in a set_fact task.. Lookup plugins execute on the control node and query external data sources during a play run, which is the supported way to pull secrets from services such as HashiCorp Vault. Assigning the lookup result to a variable with set_fact makes the secret usable by later tasks while keeping it out of the repository entirely.

Answer

An ansible-vault encrypted file committed to the project and decrypted with a password file.

Answer

A fact gathered by the setup module from the managed node's /etc/shadow file.

Answer

A host variable defined in the inventory and marked with no_log on the consuming task.

Question 14

An administrator is writing a role where a task should only execute when the variable `web_package` is defined and its value is `httpd`. The role must not fail if the variable is undefined. Which task condition is correct?

Accepted Answer

when: web_package is defined and web_package == "httpd". The task must run only when web_package is defined and its value is httpd, without failing if undefined. The condition using 'is defined' followed by 'and' correctly short-circuits so that the variable is only compared when it exists. The other conditions either fail on undefined variables, run when the variable is missing, or use incorrect logic.

Answer

when: web_package == "httpd"

Answer

when: web_package | default("httpd") == "httpd"

Answer

when: web_package is defined or web_package == "httpd"

Question 15

An administrator needs to ensure that a set of tasks runs only when a specific condition is met, and that the tasks are skipped without error otherwise. The condition depends on a variable that may be undefined. Which TWO approaches will safely evaluate the condition without causing an undefined variable error? (Choose two.)

Accepted Answer

Use the 'when' keyword with the 'is defined' test, such as "when: my_var is defined and my_var == 'value'".. Both the default filter and the 'is defined' test allow safe evaluation of potentially undefined variables in when conditions. The default filter supplies a fallback value, while 'is defined' short-circuits the condition to avoid evaluating the variable if it does not exist. Either approach prevents undefined variable errors and ensures tasks are skipped cleanly.

Answer

Use the 'ignore_errors' keyword on the task and check the variable in a subsequent task.

Answer

Use the 'failed_when' keyword to define a custom failure condition based on the variable.

Answer

Use the 'when' keyword with the variable directly, such as "when: my_var == 'value'".