EX294 Practice Test 28 — 15 Questions

Question 1

Which TWO statements about inventory groups in Ansible Automation Platform are correct? (Choose exactly two.)

Accepted Answer

A host can belong to multiple groups. Ansible's inventory system allows a host to belong to multiple groups simultaneously. This is a fundamental feature of Ansible's inventory model, enabling flexible host organization and variable inheritance from all parent groups.

Answer

Host variables are the only way to define variables for a host

Answer

Groups cannot be members of other groups

Answer

Dynamic inventory sources cannot produce groups

Question 2

You are deploying Red Hat Ansible Automation Platform in a restricted network environment where the automation controller, automation hub, and execution nodes cannot access the internet. You have successfully installed the automation controller and automation hub on separate RHEL 8 servers using a local repository. The automation hub is configured to sync collections from a local mirror. After deployment, you attempt to create a new job template that uses a collection from automation hub, but the job template creation fails with the error: 'Failed to find collection' for a collection that exists in automation hub. The execution nodes are subscribed to the same local repository. The automation controller is configured with the automation hub as the default collections server. What is the most likely cause?

Accepted Answer

The automation controller is configured with the default cloud.redhat.com as the collections server instead of the local automation hub URL.. The automation controller must be explicitly configured to use the local automation hub as the default collections server. If it defaults to cloud.redhat.com, the controller will attempt to download collections from the internet, which fails in a restricted network environment. The error 'Failed to find collection' indicates the controller cannot reach the configured collections server, not that the collection is missing from the local hub.

Answer

The local repository does not contain the required Ansible Automation Platform packages for the execution nodes.

Answer

The automation controller cannot communicate with the execution nodes due to network restrictions.

Answer

The execution nodes are not registered with the automation controller.

Question 3

A team uses Ansible Automation Controller with multiple organizations. Each organization has its own set of machines that require different SSH keys. The administrator wants to ensure that users from one organization cannot use credentials from another organization. What is the best way to achieve this isolation?

Accepted Answer

Create credentials within each organization and assign organization-level access. In Ansible Automation Controller, credentials are scoped to organizations. By creating credentials within each organization and assigning organization-level access, the administrator ensures that credentials are only visible and usable by members of that organization. This leverages the built-in role-based access control (RBAC) that isolates resources by organization, preventing cross-organization credential access.

Answer

Store credentials in separate projects and restrict project access

Answer

Set 'Use' permission on credentials only for specific users

Answer

Place users in different teams and restrict credential access by team

Question 4

An Ansible playbook uses the lineinfile module to ensure a specific line is present in a configuration file. However, after running the playbook multiple times, the line is duplicated each time. Which option best explains this behavior?

Accepted Answer

The lineinfile module is missing the regexp parameter, so it adds the line every run.. The lineinfile module without a regexp parameter cannot identify an existing line to match, so it adds the line every time the playbook runs, causing duplicates. Option B is incorrect because 'append' is not a valid state for lineinfile; valid states are 'present' (default) and 'absent'. Option C is incorrect because the backup parameter only creates a backup file and does not affect line duplication. Option D is incorrect because insertafter=EOF would place the line at the end of the file, but without a regexp, the module still cannot detect an existing matching line and will add it each run.

Answer

The state parameter is set to 'append' instead of 'present'.

Answer

The backup parameter is not set, causing file corruption.

Answer

The insertafter parameter is incorrectly set to EOF, causing multiple adds.

Question 5

An organization uses custom Ansible plugins stored in a collection. A junior admin reports that after updating the collection to version 2.0.0, a playbook that uses a custom filter plugin fails with 'undefined filter'. What is the most likely cause?

Accepted Answer

The filter plugin was placed in the wrong directory inside the collection.. In Ansible collections, filter plugins must reside in the `plugins/filter/` directory within the collection structure. If the plugin is placed in the wrong directory (e.g., `plugins/modules/` or `plugins/lookup/`), Ansible will not load it as a filter, resulting in an 'undefined filter' error. The collection update to version 2.0.0 likely reorganized the directory structure, causing the filter to be misplaced.

Answer

The playbook uses an outdated syntax that is incompatible with the new collection.

Answer

The playbook does not use the fully qualified collection name (FQCN) for the filter.

Answer

The collection's metadata file galaxy.yml is missing a dependency declaration.

Question 6

Refer to the exhibit. A playbook targeting the 'webservers' group uses '{{ http_port }}'. What will be the value of 'http_port' on 'web2'?

Accepted Answer

8080. In Ansible, host variables take precedence over group variables. The inventory defines 'web2' with 'http_port: 8080' as a host variable, while the 'webservers' group defines 'http_port: 80' as a group variable. Since host variables override group variables, the value of 'http_port' on 'web2' is 8080.

Answer

80

Answer

80, because the group variable overrides host variable.

Answer

Undefined, causing an error

Question 7

Which THREE files are commonly used when building an execution environment with ansible-builder?

Accepted Answer

bindep.txt. `bindep.txt` is one of the three files that `ansible-builder` uses by default to define system-level package dependencies (e.g., `libffi-devel`, `python3-devel`) that must be installed in the execution environment image. Along with `execution-environment.yml` (the main recipe file) and `requirements.txt` (Python package dependencies), `bindep.txt` is automatically consumed during the build process to ensure the container has the necessary OS packages.

Answer

ansible.cfg

Answer

galaxy.yml

Question 8

Your team maintains a collection that includes custom modules and plugins. You have been tasked with creating a content collection that adheres to the Red Hat Ansible Content Collection requirements. You have created the directory structure and written the collection code. Now you need to package the collection for distribution to your internal automation hub. You run 'ansible-galaxy collection build' and it completes successfully, generating a tarball. However, when you try to publish it to your private automation hub using 'ansible-galaxy collection publish', you get an authentication error. You have verified that your automation hub server URL and API token are correct. What is the most likely cause of the error?

Accepted Answer

The 'namespace' or 'name' in galaxy.yml does not match the namespace you are allowed to publish to on the automation hub.. The authentication error despite correct server URL and API token indicates that the issue is not with credentials or connectivity, but with authorization. Ansible Automation Hub enforces namespace-based access control: the `namespace` field in `galaxy.yml` must match a namespace you are permitted to publish to. If the namespace does not match, the hub rejects the upload with an authentication/authorization error, even though the token itself is valid.

Answer

The automation hub server is not reachable from your network.

Answer

The collection tarball is corrupted and needs to be rebuilt.

Answer

The collection contains a module that violates a content policy enforced by the hub.

Question 9

An Ansible playbook includes multiple roles. The administrator wants to ensure that a specific role's tasks are executed before any other roles, even if the roles are listed in a different order in the playbook. Which approach should be used?

Accepted Answer

Use the 'pre_tasks' section in the playbook to call the role.. The 'pre_tasks' section in an Ansible playbook runs before any roles listed in the 'roles' section, regardless of the order in which roles are defined. This allows the administrator to execute a specific role's tasks first by calling it within 'pre_tasks', ensuring it runs before all other roles.

Answer

Use the 'any_errors_fatal' setting.

Answer

Use role dependencies with 'allow_duplicates: no'.

Answer

Set the 'order' parameter in the role definition.

Question 10

An Ansible developer needs to use the `podman_container` module in a playbook. The module is part of the `containers.podman` collection. Which command must be run first to make the module available?

Accepted Answer

`ansible-galaxy collection install containers.podman`. The `podman_container` module is part of the `containers.podman` collection, which must be installed from Ansible Galaxy before it can be used in a playbook. The correct command is `ansible-galaxy collection install containers.podman`, which downloads and installs the collection into the local collections path, making all its modules and plugins available.

Answer

`ansible-galaxy install containers.podman`

Answer

`ansible-galaxy collection search containers.podman`

Answer

`ansible-galaxy collection install containers.podman:1.0.0`

Question 11

In OpenShift, a DeploymentConfig uses the RollingUpdate strategy. Which parameter controls the maximum number of pods that can be unavailable during an update?

Accepted Answer

maxUnavailable. In OpenShift, the RollingUpdate strategy for a DeploymentConfig uses the `maxUnavailable` parameter to specify the maximum number or percentage of pods that can be unavailable during the update process. This ensures that the desired number of pods remain available to serve traffic while the update rolls out, controlling the trade-off between update speed and availability.

Answer

minReadySeconds

Answer

maxSurge

Answer

revisionHistoryLimit

Answer

progressDeadlineSeconds

Question 12

An Ansible rolling update playbook has 'serial: 1' and 'max_fail_percentage: 0'. During the update of a 5-host group, the first host fails. What is the outcome?

Accepted Answer

The play aborts immediately. With 'serial: 1', Ansible updates one host at a time. 'max_fail_percentage: 0' means that if any host fails (0% failure tolerance), the entire playbook run is aborted immediately. When the first host fails, Ansible stops further execution because the failure percentage exceeds the threshold, and no retries or continuation occur.

Answer

The play pauses for manual intervention

Answer

The play retries the failed host

Answer

The play continues with the remaining 4 hosts

Answer

The play marks the host as unreachable and continues

Question 13

An organization wants to include custom Python packages in their execution environment to support custom modules. Which method should be used to define these Python dependencies?

Accepted Answer

Create a `requirements.txt` file and reference it in the `execution-environment.yml` under `dependencies: python:`.. The `execution-environment.yml` file supports a `dependencies` key with a `python` subkey that points to a `requirements.txt` file. This is the standard method defined by the Ansible Builder specification for including custom Python packages in an execution environment, ensuring they are installed during the build process.

Answer

List them in the `galaxy-requirements.yml` file.

Answer

Use `ansible-navigator` to install them during runtime.

Answer

Add them to the `collection-requirements.yml` file.

Question 14

Which TWO statements about Ansible roles are correct?

Accepted Answer

Ansible roles follow a predefined directory structure.. Ansible roles enforce a predefined directory structure (e.g., tasks/, handlers/, vars/, defaults/, meta/, templates/, files/) that organizes automation content into reusable components. This structure is required for Ansible to automatically locate and load role resources, making option A correct.

Answer

Roles enforce an execution order for tasks based on file naming.

Answer

A role can only be included once in a playbook.

Answer

Roles cannot have dependencies on other roles.

Question 15

An administrator needs to securely pass a database password to a playbook without exposing it in logs or the command line. Which approach is the most secure?

Accepted Answer

Store the password in an Ansible Vault-encrypted variable file and include it.. Ansible Vault encrypts the variable file at rest, and including it via `vars_files` or `include_vars` decrypts it only in memory during playbook execution. This prevents the password from appearing in logs, the command line, or the process table, meeting the security requirement.

Answer

Set the password in a variable and use 'no_log: true' on tasks that use it.

Answer

Store the password in a host_vars file with restricted file permissions.

Answer

Prompt for the password and pass it as an extra variable using -e.