EX294 Practice Test 27 — 15 Questions

Question 1

Which THREE of the following are valid directives that can be used in an `execution-environment.yml` file for `ansible-builder`?

Accepted Answer

`version:`. `version:` is a valid directive in an `execution-environment.yml` file for ansible-builder. It specifies the version of the execution environment definition format, ensuring compatibility with the builder tool. This directive is used at the top level of the file to declare the schema version, such as `version: 1`.

Answer

`system_packages:`

Answer

`python_requirements:`

Question 2

A systems administrator needs to use a different SSH private key for a group of hosts in an Ansible inventory. Which inventory variable should be set at the group level?

Accepted Answer

ansible_ssh_private_key_file. `ansible_ssh_private_key_file` is the Ansible inventory variable that specifies the path to the SSH private key file for a host or group. When set at the group level, it applies to all hosts in that group, allowing the administrator to use a different key for authentication without modifying individual host definitions.

Answer

ansible_ssh_key

Answer

ansible_ssh_key_file

Answer

ansible_private_key

Question 3

Which TWO statements are true about Ansible content collections?

Accepted Answer

Collections can be installed from Automation Hub, Galaxy, or a Git repository.. Ansible collections can be installed from multiple sources: Automation Hub (a Red Hat curated repository), Galaxy (the community repository), or directly from a Git repository using the `ansible-galaxy collection install` command with a Git URL. This flexibility allows users to leverage curated, community, or custom collections as needed.

Answer

Collections cannot contain playbooks.

Answer

A role stored in a collection can be referenced by its short name without the collection prefix.

Answer

Execution environments are required to use collections.

Question 4

Which TWO are valid ways to restrict access to job templates in Automation Controller?

Accepted Answer

Use credential types with separate permissions. Credential types in Automation Controller can be configured with their own permissions, allowing you to restrict which users or teams can use specific credentials. Since job templates require credentials to run, controlling access to credentials indirectly restricts access to the job templates that depend on them. This is a key aspect of role-based access control (RBAC) in Automation Controller.

Answer

Use tags in playbooks

Answer

Set job template to 'run at specific times'

Answer

Use inventory source filters

Question 5

An engineer runs the playbook as shown:

```yaml
- hosts: all
  tasks:
    - block:
        - name: configure firewall
          command: /bin/false
    - name: enable service
      service: name=httpd enabled=yes
    - name: start service
      service: name=httpd state=started

- hosts: all
  tasks:
    - name: next task
      debug: msg="Continuing to next play"
```

What is the expected result?

Accepted Answer

The 'configure firewall' task is executed, the 'enable service' task is skipped, and the playbook continues to the next play.. The playbook includes a block containing only the 'configure firewall' task. When this task fails and no rescue block is defined, the play fails immediately. The playbook then moves to the next play, skipping any remaining tasks in the current play, including the 'enable service' task. Thus, 'configure firewall' is executed, 'enable service' is skipped, and the playbook continues to the next play.

Answer

Only the 'configure firewall' task is executed; the rest are skipped.

Answer

All tasks are executed and the playbook completes successfully.

Answer

The 'configure firewall' and 'enable service' tasks are executed; the 'start service' task is skipped.

Question 6

A playbook uses the 'block' feature to group tasks and includes a 'rescue' section. If a task inside the block fails, what happens?

Accepted Answer

The rescue tasks run, and the play continues with the next task after the block.. In Ansible, when a task inside a `block` fails, the `rescue` section is executed to handle the failure. After the rescue tasks complete successfully, the play continues with the next task after the block, not from the beginning of the block. This behavior allows for error recovery without terminating the entire play.

Answer

The rescue tasks run, and then the entire playbook fails.

Answer

The rescue tasks are ignored and the play fails immediately.

Answer

The block is re-executed after rescue.

Question 7

An Ansible playbook uses the `ansible_password` variable to connect to a Windows host. The value is stored in an encrypted Ansible Vault file. Which credential type in Automation Controller would allow the vault password to be supplied at runtime?

Accepted Answer

Vault credential. Automation Controller's Vault credential type is specifically designed to provide the vault password needed to decrypt Ansible Vault-encrypted variables like `ansible_password`. When a job runs, the controller uses this credential to unlock the vault file, allowing the playbook to access the encrypted value at runtime without exposing the plaintext password.

Answer

Cloud credential

Answer

Machine credential

Answer

Network credential

Question 8

During a playbook run, the task 'debug: msg={{ ansible_facts.distribution }}' outputs 'CentOS' for a host. However, the host's inventory variable 'distribution' is set to 'RedHat'. The administrator expected the inventory variable to override the fact. What is the most likely cause of this behavior?

Accepted Answer

The ansible_facts dictionary is used, which contains discovered facts that take precedence over inventory variables. In Ansible, facts discovered by the `setup` module (stored in `ansible_facts`) take precedence over inventory variables when accessed via the `ansible_facts` dictionary. The `debug` task explicitly references `ansible_facts.distribution`, which retrieves the discovered fact value ('CentOS'), not the inventory variable `distribution`. Inventory variables are stored separately and do not override facts within the `ansible_facts` namespace.

Answer

The 'gather_facts' directive is set to 'no' in the playbook

Answer

The host variable is defined in a group_var that is overridden by a host_var

Answer

The playbook uses the variable 'distribution' instead of 'ansible_facts.distribution'

Question 9

What is the most likely cause of the build failure?

Accepted Answer

The base image already includes python3-devel, causing a conflict with the bindep.txt entry.. The build failure is most likely caused by a conflict between the base image's pre-installed python3-devel package and the bindep.txt entry that also specifies python3-devel. In Ansible Builder, bindep.txt lists system packages to install via dnf, but if the base image already includes that package, the build process may fail due to duplicate or conflicting package manager operations, especially if the base image uses a different package version or repository configuration.

Answer

The package_manager_path should be /usr/bin/dnf.

Answer

The version field in execution-environment.yml is incorrect.

Answer

The base image name is misspelled.

Question 10

An Ansible playbook is failing due to an undefined variable. Which approach would best help identify the source of the variable?

Accepted Answer

Add a debug task with var: hostvars[inventory_hostname]. Adding a debug task with `var: hostvars[inventory_hostname]` dumps all variables for the current host, including those inherited from group_vars, host_vars, and play-level vars. This allows you to inspect the full variable namespace and identify which variable is undefined or missing, directly addressing the root cause of the failure.

Answer

Add the 'ignore_errors: yes' directive

Answer

Set environment variable ANSIBLE_DEBUG=1

Answer

Use the --syntax-check flag

Question 11

Your security team requires that all containers used in production must be scanned for vulnerabilities and must not contain any unnecessary packages to reduce attack surface. You are building an execution environment based on the 'ee-minimal-rhel8' image from Red Hat. You need to add a custom Python library named 'my_lib' that is available on a private PyPI server. You also need to install a collection from a private Git repository. The execution environment must be as small as possible. Which approach to building the execution environment satisfies the security and size requirements?

Accepted Answer

Use a multi-stage build in the execution-environment.yml by specifying 'additional_build_steps' to first install build dependencies, then install the library and collection, and finally remove build dependencies.. A multi-stage build in the execution-environment.yml using 'additional_build_steps' allows you to install build dependencies (e.g., gcc, python3-devel) needed to compile 'my_lib', install the library from the private PyPI server, install the collection from the private Git repository, and then remove all build dependencies in a subsequent stage. This results in a final image that contains only the runtime artifacts, minimizing the attack surface and image size, satisfying the security and size requirements.

Answer

Use the 'dependencies' key for the Python library and the 'git' option for the collection, which automatically handles minimization.

Answer

Build a custom base image that already includes the library and collection, then reference it as the base image.

Answer

Add the library and collection installation commands to the 'additional_build_steps' section without any cleanup steps.

Question 12

An administrator is designing a workflow that includes an approval node. The workflow should pause at the approval node until a user with the appropriate role approves or denies. The workflow is triggered by a webhook. After setting up, the webhook successfully starts the workflow, but the approval node is never created. What is the most likely cause?

Accepted Answer

The workflow job template is set to run as a system user, but the approval node requires an actual user to approve.. In Ansible Automation Platform, approval nodes in workflows require a real user to approve or deny the request. If the workflow job template is configured to run as a system user (e.g., the automation controller system user), there is no actual user identity associated with the approval action, so the approval node is never created. The webhook can still trigger the workflow, but the approval node fails to materialize because the system user lacks the necessary user context to generate the approval request.

Answer

The approval node requires a notification template to be configured.

Answer

The approval node's timeout is set to 0, causing it to be skipped.

Answer

The inventory for the workflow does not have proper machine credentials.

Question 13

A systems administrator needs to securely store a database password for use in an Ansible playbook. The password should be encrypted at rest and decrypted only at runtime when the playbook is executed. Which approach should the administrator take?

Accepted Answer

Use the ansible-vault encrypt_string command to encrypt the password and store it in a variables file.. `ansible-vault encrypt_string` encrypts the password at rest using AES-256, storing it as a ciphertext string in a variables file. At runtime, when the playbook is executed with `--ask-vault-pass` or a vault password file, Ansible decrypts the value transparently, ensuring the plaintext password is never written to disk or logs.

Answer

Store the password as a plain text variable in the playbook and use the no_log: yes directive to prevent logging.

Answer

Store the password in an unprotected external file and reference it with include_vars.

Answer

Save the password in an environment variable and access it via lookup('env','DB_PASS').

Question 14

Refer to the exhibit. An administrator wants to view the decrypted value of 'db_password' without modifying the file. Which command should be used?

Accepted Answer

ansible-vault view file.yml. The `ansible-vault view` command decrypts the file in memory and displays its contents to stdout without modifying the encrypted file on disk. This is the correct choice because the administrator only needs to see the decrypted value of 'db_password' and does not want to change the file.

Answer

ansible-vault rekey file.yml

Answer

ansible-vault decrypt file.yml

Answer

ansible-vault edit file.yml

Question 15

A sysadmin receives an error when running a job template: 'ERROR! the role 'common' was not found in the specified roles path'. The role exists in a source control repository referenced in the project. What is the most likely cause?

Accepted Answer

The project's source control sync failed, so the roles directory is empty. The error indicates that Ansible cannot find the 'common' role in the specified roles path. Since the role exists in the source control repository referenced by the project, the most likely cause is that the project's source control sync failed, leaving the roles directory empty or incomplete. Without a successful sync, the role files are not present on the Ansible control node, causing the job template execution to fail.

Answer

The inventory does not include the target hosts

Answer

The job template is configured with an incorrect schedule

Answer

The credential used does not have access to the source control repository