EX294 Practice Test 28 — 15 Questions

Question 1

A team is setting up an Ansible execution environment that requires a specific version of a Python library that is not available in the default base image. The team wants to minimize the size of the final container. Which approach should they take in the execution-environment.yml file?

Accepted Answer

Use the 'dependencies' key with 'python' to specify the library and version.. Option C is correct because the `dependencies` key in `execution-environment.yml` allows specifying Python libraries and their versions under the `python` subkey. Ansible Builder will then install these dependencies during the build process, ensuring the required library is available without bloating the final container with unnecessary layers or manual RUN commands.

Answer

Use the 'additional_build_steps' key to add a RUN command that installs the library via pip.

Answer

Use the 'base_image' key to point to a custom image that already contains the library.

Answer

Use the 'galaxy' key to install the library from a collection.

Question 2

An Ansible content creator wants to ensure that a collection is properly structured and meets Red Hat's best practices. Which TWO of the following are required files in a valid Ansible collection structure?

Accepted Answer

meta/runtime.yml. A is correct because `meta/runtime.yml` is a required file in a valid Ansible collection structure. It defines the collection's runtime dependencies, such as minimum Ansible version and action group mappings, ensuring the collection is compatible with the Ansible runtime environment. B is correct because `galaxy.yml` is the mandatory metadata file that describes the collection's name, version, authors, and other essential information, and it is required for publishing to Ansible Galaxy or Automation Hub.

Answer

plugins/README.md

Answer

requirements.yml

Answer

roles/requirements.yml

Question 3

An organization is deploying Automation Platform for the first time. The security team requires that all SSH private keys used for automation be stored securely with access controls. Which AAP feature should be used to meet this requirement?

Accepted Answer

Create a Machine credential type and upload the SSH private key.. Option D is correct because the Machine credential type in Ansible Automation Platform (AAP) is specifically designed to securely store SSH private keys. When you upload the private key via the AAP web UI or API, it is encrypted at rest in the AAP database and access is controlled through role-based access control (RBAC). This meets the security team's requirement for secure storage and access controls without exposing the key in plain text.

Answer

Store the private key in plain text within the inventory file.

Answer

Use Ansible Vault to encrypt the private key file.

Answer

Set the SSH key as an environment variable on the controller.

Question 4

A job template consistently fails with 'Authentication failed' for a managed host. The admin has verified that the username/password in the credential is correct and that the host is reachable. What is the most likely remaining cause?

Accepted Answer

The credential is not linked to the job template.. The most likely remaining cause is that the credential is not linked to the job template. Even if the credential contains correct authentication data, the job template will not use it unless the credential is explicitly associated. Without this link, Ansible Tower/AWX cannot authenticate to the managed host, resulting in an 'Authentication failed' error.

Answer

The SSH private key has not been added to the credential.

Answer

The username in the credential is misspelled.

Answer

The host is not reachable on the network.

Question 5

An admin is configuring a project in Automation Platform to pull playbooks from a Git repository. Which source control type should be selected?

Accepted Answer

SCM. Option C (SCM) is correct because Ansible Automation Platform uses Source Control Management (SCM) to integrate with Git repositories. When configuring a project, selecting 'SCM' allows the platform to pull playbooks, roles, and inventories directly from a remote Git repository, enabling version control and automated sync.

Answer

Local

Answer

Manual

Answer

Red Hat Insights

Question 6

An organization is designing a high-availability Automation Platform deployment. Which TWO practices are essential for achieving high availability?

Accepted Answer

Deploy multiple automation controllers behind a load balancer.. Option C is correct because deploying multiple automation controllers behind a load balancer distributes workload and provides failover: if one controller fails, the load balancer redirects traffic to healthy nodes, ensuring continuous job execution and API availability. This is a core high-availability pattern for Ansible Automation Platform, as the controllers are stateless and can share the same database and project storage.

Answer

Use a single instance of PostgreSQL on the controller node.

Answer

Installation on a single powerful node.

Answer

Store all secrets in the Automation Platform vault.

Question 7

Which THREE of the following are core components of Automation Platform that are installed by default in a standard setup?

Accepted Answer

Automation controller. Option B is correct because Automation controller (formerly Ansible Tower) is the web-based UI and REST API platform that provides role-based access control, job scheduling, and inventory management for Ansible automation. It is installed by default as part of a standard Red Hat Ansible Automation Platform setup to serve as the central control plane.

Answer

Red Hat Enterprise Linux

Answer

Ansible Core

Question 8

A job template has failed. Which TWO logs should be examined first to diagnose the issue?

Accepted Answer

/var/log/tower/tower.log. Option A is correct because `/var/log/tower/tower.log` is the primary log file for the Ansible Tower/Automation Controller service itself, capturing all controller-level events, errors, and system messages. When a job template fails, this log is the first place to check for underlying service issues, authentication failures, or configuration problems that prevented the job from starting or completing. Option B is correct because `/var/log/tower/job_callback.log` specifically records callback data from job runs, including the final status and any errors returned by the Ansible playbook execution, making it essential for diagnosing job-specific failures.

Answer

Automation controller job stdout

Answer

/var/log/messages

Answer

/var/log/nginx/access.log

Question 9

An admin checks the job details and sees this error from the API. What is the most likely cause?

Accepted Answer

The callback plugin is not installed on the controller node.. The error from the API indicates that the callback plugin is missing on the controller node. In Ansible Automation Platform, callback plugins must be installed on the controller node (or execution node) where `ansible-runner` processes job events. If the plugin is not present there, the API will report a failure when the job attempts to use it, even if the execution environment contains the plugin.

Answer

The job template is using an execution environment that lacks the plugin.

Answer

The callback plugin name is misspelled in the project.

Answer

The machine credential is invalid.

Question 10

Which TWO should be configured to enable centralized logging from multiple Automation Controller nodes to an external Elasticsearch cluster? (Choose two.)

Accepted Answer

Configure a logging aggregator in the controller's system settings to point to the Elasticsearch endpoint.. Option D is correct because Automation Controller (formerly Ansible Tower) provides a built-in logging aggregator configuration in its system settings. By specifying the Elasticsearch endpoint there, the controller itself handles forwarding all relevant job and system logs from every node to the external Elasticsearch cluster, without requiring per-node agents.

Answer

Configure `logrotate` to ensure logs are not truncated before being sent.

Answer

Set up `rsyslog` on each node to forward application logs to Elasticsearch.

Answer

Install and configure `filebeat` on each controller node as a sidecar service.

Question 11

An administrator is designing a workflow that includes an approval node. The workflow should pause at the approval node until a user with the appropriate role approves or denies. The workflow is triggered by a webhook. After setting up, the webhook successfully starts the workflow, but the approval node is never created. What is the most likely cause?

Accepted Answer

The workflow job template is set to run as a system user, but the approval node requires an actual user to approve.. Option B is correct because in Ansible Automation Platform, approval nodes in workflows require a real user to approve or deny the request. If the workflow job template is configured to run as a system user (e.g., the automation controller system user), there is no actual user identity associated with the approval action, so the approval node is never created. The webhook can still trigger the workflow, but the approval node fails to materialize because the system user lacks the necessary user context to generate the approval request.

Answer

The approval node requires a notification template to be configured.

Answer

The approval node's timeout is set to 0, causing it to be skipped.

Answer

The inventory for the workflow does not have proper machine credentials.

Question 12

What is the most likely cause of this error?

Accepted Answer

The filter name is incorrect; no filter named 'encrypt_string' exists by default.. The error occurs because there is no built-in filter named 'encrypt_string' in Ansible. While Ansible provides many filters for data transformation, 'encrypt_string' is not one of them by default. This filter would need to be provided by a custom filter plugin or a collection, and since it is not present, Ansible raises an undefined filter error.

Answer

The `filter_plugins` path is misconfigured.

Answer

The `encrypt_string` filter plugin is not installed.

Answer

The playbook syntax is invalid.

Question 13

An organization uses Ansible Automation Controller. They have an inventory source that syncs from a Git repository containing `inventory/hosts.yml`. The job template uses this inventory. Recently, the inventory stopped updating. The admin checks the job logs and sees: `ERROR! Could not update inventory source: invalid inventory source definition`. What is the most likely issue?

Accepted Answer

The inventory file `hosts.yml` has a syntax error, such as a missing colon.. The error message 'invalid inventory source definition' indicates that the inventory file itself is malformed, not that there is a connectivity or credential issue. In Ansible Automation Controller, when an inventory source syncs from a Git repository, the controller parses the inventory file (e.g., `hosts.yml`) according to YAML syntax rules. A missing colon would break the YAML structure, causing the controller to reject the file as invalid, which matches the error.

Answer

The Git repository is unreachable due to network issues.

Answer

The project that contains the playbook has been deleted.

Answer

The machine credential stored in the controller has expired.

Question 14

You have two dictionaries: `dict1: {a: 1, b: 2}` and `dict2: {b: 3, c: 4}`. You want a new dict that combines both, with `dict2` values taking precedence for overlapping keys. Which filter chain achieves this?

Accepted Answer

`dict1 | combine(dict2)`. Option D is correct because the `combine` filter in Ansible merges two dictionaries, and when used with the pipe operator, the left-hand dictionary's values take precedence for overlapping keys. Here, `dict1 | combine(dict2)` ensures that for the overlapping key `b`, the value from `dict2` (3) overwrites the value from `dict1` (2), producing `{a: 1, b: 3, c: 4}`.

Answer

`dict2 | combine(dict1, recursive=True)`

Answer

`dict2 | combine(dict1)`

Answer

`[dict1, dict2] | combine`

Question 15

An admin attempts to run this playbook as a job template in AAP. The job fails with 'ERROR! 'now' is not a valid attribute for a task'. What is the issue?

Accepted Answer

The 'now' attribute does not exist; it may be a typo for 'notify' or should be removed.. Option D is correct because the error message 'ERROR! 'now' is not a valid attribute for a task' indicates that Ansible does not recognize 'now' as a valid task attribute. The 'now' keyword is not a standard Ansible directive; it is likely a typo for 'notify' (used with handlers) or should be removed entirely. Ansible validates task attributes against a strict schema, and any unknown attribute causes a parsing failure.

Answer

The template task is missing quotes around the file paths.

Answer

The playbook has an incorrect indentation in the tasks block.

Answer

The 'become' directive is placed incorrectly at the play level.