EX294 Practice Test 28 — 15 Questions

Question 1

You are developing a content collection and need to include a custom Ansible module that requires a specific Python library. The library is not available as a system package and must be installed via pip. Where should you declare this Python dependency so that it is automatically installed when the collection is used in an execution environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the execution-environment.yml file under the dependencies section with the python option.. When building an execution environment, Python dependencies can be declared in the execution-environment.yml file under the dependencies section with the python key. This instructs ansible-builder to install the specified Python packages via pip into the execution environment, making them available to modules and plugins that require them.

Answer

In the galaxy.yml file under the dependencies key, specifying the Python package name.

Answer

In the module file itself, using a try/except ImportError block to install the library at runtime.

Answer

In the requirements.txt file within the collection root.

Question 2

A playbook must connect to hosts using a non-default SSH private key stored at /home/student/.ssh/prod_key and a non-default remote user 'deploy'. The inventory file should apply these settings to all hosts in the 'production' group without editing the playbook. Which inventory variable combination is correct?

Accepted Answer

[production:vars]
ansible_ssh_private_key_file=/home/student/.ssh/prod_key
ansible_user=deploy. Ansible uses connection variables prefixed with ansible_ to override SSH behavior. ansible_ssh_private_key_file specifies the key, and ansible_user sets the remote user. Placing them in a group vars section applies them to all hosts in that group, satisfying the scenario without modifying the playbook.

Answer

[production:vars]
private_key_file=/home/student/.ssh/prod_key
remote_user=deploy

Answer

[production:vars]
ssh_private_key_file=/home/student/.ssh/prod_key
user=deploy

Answer

[production:vars]
ansible_ssh_key=/home/student/.ssh/prod_key
ansible_remote_user=deploy

Question 3

A developer is creating a new content collection named `acme.automation` and wants to ensure that the collection is structured correctly for distribution. After running `ansible-galaxy collection init acme.automation`, which directory should contain the custom Ansible modules that the collection will provide?

Accepted Answer

`plugins/modules/`. Ansible collections organize plugins by type. Modules are a type of plugin and belong in `plugins/modules/`. This structure allows Ansible to load modules from the collection namespace. Other directories like `roles/` or `library/` serve different purposes and are not scanned for collection modules. Using the correct directory is essential for the collection to work as intended.

Answer

`roles/modules/`

Answer

`modules/`

Answer

`library/`

Question 4

A playbook must read a vault-encrypted variable file named secrets.yml and also use a vault password stored in a file named vault_pass.txt. The playbook is executed with the command `ansible-playbook site.yml --vault-password-file vault_pass.txt`. The file secrets.yml was encrypted with the same password. During execution, the task that uses a variable from secrets.yml fails with an error indicating the variable is undefined. What is the most likely reason?

Accepted Answer

The vault-encrypted variable file must be included with vars_files in the playbook, not merely present in the same directory.. Variables from a vault-encrypted file are only available to a play if the file is explicitly loaded, commonly through vars_files or include_vars. Merely placing the encrypted file alongside the playbook and supplying the vault password does not make its variables available, so the task referencing them fails with an undefined variable error.

Answer

The vault password file must be passed with --vault-id instead of --vault-password-file.

Answer

The vault password file must have permissions of 0600, otherwise Ansible ignores it.

Answer

The variable file must be decrypted to plaintext before it can be used in a playbook.

Question 5

A developer is creating a new content collection and wants to include a custom module that requires the `requests` Python library. The collection will be used in an execution environment. Where should the developer declare this Python dependency so that it is automatically installed when the execution environment is built?

Accepted Answer

In the `execution-environment.yml` file under the `dependencies` section with a `python` key.. Python dependencies for an execution environment are declared in the `execution-environment.yml` file under the `dependencies` section, using the `python` key to list packages or a requirements file. This allows `ansible-builder` to install them during the build process. Other files like `galaxy.yml` or `meta/runtime.yml` serve different purposes and do not trigger Python package installation.

Answer

In a `requirements.txt` file at the root of the collection.

Answer

In the collection's `meta/runtime.yml` file under `requires_ansible`.

Answer

In the collection's `galaxy.yml` file under a `dependencies` key.

Question 6

A playbook registers the output of a shell command that returns a JSON string. You need to parse this JSON string into a usable dictionary within the same play. Which filter should you apply to the registered variable?

Accepted Answer

from_json. When a command returns JSON as a string, the registered variable stores that string, not a parsed object. The `from_json` filter is specifically designed to deserialize JSON strings into Ansible data structures, enabling direct access to nested keys. Using the wrong direction or a query filter would not achieve the required parsing.

Answer

json_query

Answer

from_yaml

Answer

to_json

Question 7

You are performing a rolling update of a 15-node RHEL cluster with an Ansible playbook that uses `serial: 5`. During the second batch, a host fails to restart its application service, and the task fails. You want the playbook to stop the entire rollout immediately so that no further batches are updated, allowing you to investigate the failure. Which play keyword should you set to achieve this behavior?

Accepted Answer

`any_errors_fatal: true`. To stop the entire play immediately when any task fails on any host, the play must set any_errors_fatal to true. This keyword overrides the default behavior where a failed host is removed and other hosts continue, causing the whole run to abort as soon as the failure occurs. It is the correct mechanism for halting a rolling update on the first error.

Answer

`max_fail_percentage: 0`

Answer

`ignore_errors: false` on the service restart task.

Answer

`serial: 1`

Question 8

An administrator needs to encrypt a sensitive variable file 'secrets.yml' using Ansible Vault so that it can be safely stored in a Git repository. The file should remain encrypted at rest but be automatically decrypted during playbook runs when the vault password is supplied. Which command correctly creates the encrypted file?

Accepted Answer

ansible-vault encrypt secrets.yml --vault-password-file vault_pass.txt. The ansible-vault encrypt command is the correct tool to encrypt an existing plaintext file. Using --vault-password-file provides the password non-interactively, enabling automation. The resulting file remains encrypted at rest and is decrypted automatically during playbook runs when the same vault password is supplied.

Answer

ansible-vault rekey secrets.yml --new-vault-password-file newpass.txt

Answer

ansible-vault create secrets.yml --encrypt-vault-id default

Answer

ansible-vault encrypt_string secrets.yml --name secrets

Question 9

A playbook reads a JSON file on the control node with the `file` lookup and registers the content as a string named `raw_config`. A task must convert that string into a native Python dictionary so later tasks can reference keys such as `raw_config.database.port`. Which filter should be applied to the registered content?

Accepted Answer

from_json. The registered content is a string because the lookup returns file contents verbatim. To use nested keys, that string must be parsed into Ansible's native data structures. The `from_json` filter performs exactly this deserialization, turning a JSON object string into a dictionary that supports dotted access. The reverse filter or YAML-specific parsers would not produce the required dictionary from a JSON string.

Answer

combine

Answer

from_yaml

Answer

to_json

Question 10

An automation team uses Ansible Automation Platform to manage secrets. They have a requirement that certain tasks must not log sensitive output to the Ansible logs. Which Ansible task keyword should be used to prevent a task from logging its output?

Accepted Answer

`no_log: true`. The `no_log` keyword is specifically designed to prevent Ansible from logging a task's output. When set to `true`, it suppresses the output that would normally appear in logs, including any sensitive data. This is the recommended approach for tasks that handle passwords, API keys, or other secrets. The other keywords control privilege escalation, error handling, or dry-run mode, none of which address logging of sensitive information.

Answer

`ignore_errors: true`

Answer

`check_mode: true`

Answer

`become: true`

Question 11

An administrator needs to create a new Ansible content collection named `myorg.automation` that will contain roles and modules. Which command initializes the collection directory structure with the required skeleton files?

Accepted Answer

ansible-galaxy collection init myorg.automation. The `ansible-galaxy collection init` command is the correct way to create a new collection skeleton. It sets up the directory structure with the namespace and collection name, and generates essential files like `galaxy.yml` and `README.md`. Other commands either initialize roles (`ansible-galaxy init`) or serve entirely different purposes.

Answer

ansible-playbook --init-collection myorg.automation

Answer

ansible-galaxy init myorg.automation

Answer

ansible-builder init myorg.automation

Question 12

An administrator is deploying a containerized Ansible Automation Platform 2.4 on RHEL 9. After running the installer, the `automation-controller` containers fail to start, and the installer log reports that the `podman` service is not running. The administrator confirms that `podman` is installed. Which action should the administrator take to resolve the failure?

Accepted Answer

Enable and start the `podman.socket` service, then rerun the installer. The containerized AAP installer relies on the Podman API, which is exposed by `podman.socket`. When that socket is inactive, container operations fail even though the Podman binary is present. Enabling and starting `podman.socket`, then rerunning the installer, restores the API endpoint and allows the AAP container services to start successfully.

Answer

Add the `awx` user to the `docker` group and restart the `automation-controller` service

Answer

Set `container_runtime=podman` in the inventory and rerun `setup.sh`

Answer

Install the `docker-ce` package and configure the installer to use Docker instead of Podman

Question 13

An administrator is writing a playbook that must execute a task only when a file exists on the remote host. They use the `stat` module to check the file and register the result. Which conditional expression should be used to run a subsequent task based on the file's existence?

Accepted Answer

`when: stat_result.stat.exists`. The `stat` module returns a dictionary where the `stat` key contains the file status information. The correct way to check if the file exists is to reference `stat_result.stat.exists`. This ensures the conditional evaluates correctly based on the module's output.

Answer

`when: stat_result.exists`

Answer

`when: stat_result.stat.is_exists`

Answer

`when: stat_result.is_exists`

Question 14

A playbook uses a variable named `db_port` that must be defined by the user at runtime, but should fall back to 5432 if the user does not provide it. Which approach ensures this behavior without failing the play when the variable is undefined?

Accepted Answer

Use the `default` filter: `{{ db_port | default(5432) }}`.. The `default` filter is the correct mechanism because it supplies a fallback only when the variable is undefined, allowing user-provided values to take precedence. It avoids interactive prompts and precedence conflicts, and it works in any templated context. The other options either force a value, require interaction, or fail to provide a value at all.

Answer

Define `db_port` in `group_vars/all.yml` with a value of 5432.

Answer

Reference `db_port` directly and set `ignore_errors: true` on the task.

Answer

Use `vars_prompt` to ask for `db_port` with a `default` keyword set to 5432.

Question 15

You provision a new RHEL 9 control node and create a project directory at /home/devops/ansible. While testing connectivity with `ansible all -m ping`, every host returns UNREACHABLE, yet `ssh` from the shell to those same hosts works without a password. The inventory file at /home/devops/ansible/inventory defines the group `web` with `web1 ansible_host=10.20.30.41`. Which action most directly resolves the failure?

Accepted Answer

Add `ansible_user=devops` to the inventory host entry or run the ad-hoc command with `-u devops`.. Because manual SSH succeeds but Ansible cannot connect, the difference lies in the identity Ansible uses. Ansible defaults to the local account name for remote logins, so when that name differs from the account holding the authorized key, the connection is refused and hosts are marked UNREACHABLE. Defining the correct remote user in inventory or on the command line restores key-based access without altering the transport.

Answer

Add `ansible_connection=local` to the inventory host entry.

Answer

Add `ansible_python_interpreter=/usr/bin/python3` to the inventory host entry.

Answer

Install the `sshpass` package on the control node.