EX294 Practice Test 29 — 15 Questions

Question 1

An administrator wants to apply a role to a subset of hosts based on a condition. The condition should be evaluated for each host individually. Which approach is correct?

Accepted Answer

Use the 'when' directive on the role inclusion in the play.. The 'when' directive on a role inclusion evaluates the condition for each host, applying the role only where the condition is true. This is the correct method for per-host conditional role application. Tags, become, and delegate_to serve different purposes and do not provide conditional execution based on host-specific variables.

Answer

Use the 'tags' directive on the role and run the playbook with '--tags'.

Answer

Use the 'become' directive on the role to control privilege escalation.

Answer

Use the 'delegate_to' directive on the role to target specific hosts.

Question 2

An automation engineer is using Ansible to manage a fleet of servers. They need to ensure that certain tasks run only on hosts that match specific criteria. Which two of the following are valid ways to limit task execution based on host facts? (Choose two.)

Accepted Answer

Use the 'group_by' module to create dynamic groups based on facts, then target those groups in subsequent plays.. The 'when' conditional and the 'group_by' module are both valid methods to limit task execution based on host facts. The 'when' clause evaluates facts per host, while 'group_by' dynamically creates groups that can be targeted in subsequent plays. Tags, delegate_to, and run_once do not provide fact-based filtering of hosts.

Answer

Use the 'tags' keyword to tag tasks with fact values, then run the playbook with --tags to filter.

Answer

Use the 'delegate_to' directive with a fact-based expression to delegate tasks to matching hosts.

Answer

Use the 'run_once' keyword with a fact-based condition to run the task only on the first matching host.

Question 3

An administrator is rolling out a configuration change to a fleet of 12 application servers. The change must be applied to one server at a time so that the load balancer always has 11 healthy backends. Which playbook directive guarantees this behavior?

Accepted Answer

serial: 1. serial defines how many hosts Ansible includes in each rolling batch. Setting serial: 1 ensures the entire play finishes on one host before the next host begins, which keeps 11 of 12 servers available to the load balancer. Other keywords such as throttle and forks affect parallelism or task concurrency, but they do not create per-host rolling batches.

Answer

throttle: 1

Answer

order: sequential

Answer

forks: 1

Question 4

An automation controller administrator needs to ensure that a vault password used by multiple job templates is rotated periodically without editing each job template. Which approach is most efficient and secure?

Accepted Answer

Create a single vault credential, attach it to all relevant job templates, and update the credential when rotating the password.. A shared vault credential in automation controller allows multiple job templates to use the same secret. Rotating the password only requires updating the credential, which automatically applies to all attached job templates. This is both efficient and secure, as the credential is encrypted and access-controlled.

Answer

Store the vault password in a file on the automation controller and reference it from each job template's extra variables.

Answer

Use a separate vault credential for each job template so that rotation can be done independently.

Answer

Embed the vault password in the playbook repository and use a source control webhook to trigger updates.

Question 5

An administrator is creating a new inventory file for a small environment. The inventory must define a group `app` containing hosts `app1` and `app2`, and a group `db` containing host `db1`. The administrator wants to use the INI format. Which inventory file content correctly defines these groups?

Accepted Answer

[app]
app1
app2

[db]
db1. Ansible INI inventory files use square-bracketed group names followed by one host per line. The correct content defines the `app` group with app1 and app2 on separate lines, and the `db` group with db1. The other options use invalid syntax such as key-value pairs, non-standard keywords, or comma-separated hosts, which Ansible would not parse as intended.

Answer

app: app1, app2
db: db1

Answer

[app]
app1, app2
[db]
db1

Answer

group app
host app1
host app2
group db
host db1

Question 6

An administrator needs to run a playbook that applies a configuration only to hosts that have a specific fact, `ansible_processor_vcpus`, greater than 4. The playbook should skip hosts that do not meet this condition. Which approach should be used?

Accepted Answer

Add a `when` condition to each task: `when: ansible_processor_vcpus > 4`.. The most direct method to conditionally run tasks based on a fact is to use a when condition on the tasks. Since Ansible gathers facts by default, ansible_processor_vcpus is available, and the condition will evaluate correctly per host. This ensures that only hosts with more than 4 vCPUs execute the configuration, while others skip it.

Answer

Set `gather_facts: no` and use a custom fact to check vCPU count.

Answer

Use the `serial` keyword to limit execution to hosts with more than 4 vCPUs.

Answer

Create a dynamic inventory script that only includes hosts with more than 4 vCPUs.

Question 7

An administrator manages a static inventory file with a group `web` defined as children of `production`. The inventory also defines a group variable `http_port=80` at the `all` group level and `http_port=8080` at the `web` group level. A playbook targets `hosts: web` and uses `{{ http_port }}` in a template. Which value will be used for hosts in the `web` group?

Accepted Answer

8080, because variables defined at the `web` group override those at the `all` group.. Ansible group variable precedence follows group depth: variables in child groups override those in parent groups. Since `web` is a child of `production` and `all` is the root, the `web` group variable http_port=8080 takes precedence over the `all` group variable http_port=80 for hosts in `web`. This ensures more specific settings are used. The other options misstate the precedence rules.

Answer

80, because variables defined at the `all` group take precedence over child groups.

Answer

80, because the play targets `web` but the variable is defined at `all` and that is the default.

Answer

8080, because the last definition in the inventory file wins regardless of group hierarchy.

Question 8

An administrator manages a mixed fleet of Linux servers and Windows servers using Ansible Automation Platform. The Linux hosts are accessed via SSH keys, while the Windows hosts require WinRM with username and password. The administrator wants to define connection credentials in an inventory file so that playbooks can target both groups without specifying credentials in the playbook. Which inventory variable should be used to set the username for WinRM connections?

Accepted Answer

ansible_user. The ansible_user inventory variable sets the remote username for all connection types, including WinRM. For Windows hosts, ansible_user and ansible_password are used with the winrm connection plugin. Defining these in group_vars ensures credentials are applied consistently without modifying playbooks.

Answer

ansible_ssh_user

Answer

ansible_connection_user

Answer

ansible_winrm_user

Question 9

An automation engineer manages two data centers with Ansible Automation Platform 2.4. The production inventory file is located at /etc/ansible/prod_inventory.ini and the staging inventory at /etc/ansible/stage_inventory.ini. The engineer wants to run a playbook against both inventories in a single ansible-playbook command, but the host groups must remain separate so that group_vars/prod and group_vars/stage apply correctly. Which command should the engineer use?

Accepted Answer

ansible-playbook -i /etc/ansible/prod_inventory.ini -i /etc/ansible/stage_inventory.ini site.yml. Ansible supports multiple inventory sources by repeating the -i option. Each source is parsed separately and merged, preserving distinct group names so that group_vars directories are applied based on group membership. Using a single -i with a comma-separated list or additional positional arguments does not achieve the same result and will cause errors.

Answer

ansible-playbook --inventory=/etc/ansible/prod_inventory.ini --inventory=/etc/ansible/stage_inventory.ini site.yml

Answer

ansible-playbook -i /etc/ansible/prod_inventory.ini,/etc/ansible/stage_inventory.ini site.yml

Answer

ansible-playbook -i /etc/ansible/prod_inventory.ini /etc/ansible/stage_inventory.ini site.yml

Question 10

An automation architect is deploying Red Hat Ansible Automation Platform 2.4 on a RHEL 9 control node. The setup bundle has been extracted, and the admin runs `./setup.sh` from the installer directory. During the pre-flight checks, the installer reports that the PostgreSQL database is not reachable and aborts. The admin confirms that the database server is running and that the inventory file contains the correct hostname. Which action should the admin take to resolve the installation failure?

Accepted Answer

Verify that the `pg_hba.conf` file on the database server allows connections from the automation controller node and that the `postgresql` service is listening on the correct network interface.. The installer's pre-flight check verifies that the automation controller can reach the PostgreSQL database using the inventory-defined host and credentials. When the database service is running but unreachable, the most common causes are restrictive `pg_hba.conf` entries or the service binding only to the loopback interface. Verifying these settings ensures the controller can establish the required connection.

Answer

Edit the inventory file to set `pg_port=5432` and `pg_ssl=false` to force a plain-text connection to the database.

Answer

Disable the firewall on the automation controller node using `systemctl stop firewalld` and rerun `./setup.sh`.

Answer

Re-run the installer with the `--skip-preflight` flag to bypass the database check and complete the installation.

Question 11

A playbook must run only against hosts that belong to both the `webservers` group and the `production` group. Your inventory defines these as separate groups, and a host named web3 is a member of both. Which inventory pattern restricts the play's hosts to exactly that intersection?

Accepted Answer

hosts: webservers:&production. Ansible group patterns use colon-prefixed operators: a leading ampersand means intersection, a leading exclamation mark means exclusion, and a bare colon means union. Placing an ampersand before the second group limits the selection to hosts that are members of both groups, which matches the requirement that only hosts in webservers and production be targeted by the play.

Answer

hosts: webservers:production

Answer

hosts: webservers[production]

Answer

hosts: webservers:!production

Question 12

An administrator is using Ansible Vault to protect sensitive variables in an inventory project. The project has a vault-encrypted file 'secrets.yml' that contains the variable 'db_password'. The playbook needs to use this variable. Which TWO statements are correct about using vault-encrypted variables in this scenario? (Choose two.)

Accepted Answer

The vault password can be provided at runtime using the --ask-vault-pass option when running ansible-playbook.. Providing the vault password interactively with --ask-vault-pass or via a vault password file with --vault-password-file are both valid methods to decrypt vault-encrypted files. The password file can be a script that outputs the password, which is useful for automation. Vault-encrypted files can be used for any variables, including inventory variables, and do not require an unencrypted reference file.

Answer

The variable db_password must be defined in a separate unencrypted file that references the encrypted one.

Answer

The vault-encrypted file must be listed in the ansible.cfg file under the [defaults] section as vault_identity_list.

Answer

Vault-encrypted variables can only be used in playbooks, not in inventory variables.

Question 13

An administrator needs to run a playbook in check mode to preview changes on managed hosts, but a critical task using the `command` module must always execute regardless of check mode. Which task directive should be applied to that specific task?

Accepted Answer

`check_mode: no`. The `check_mode: no` task directive overrides the playbook-level check mode for that specific task, forcing it to execute normally even when `--check` is used. This is essential for tasks that must always run, such as those that gather facts or perform critical operations that should not be simulated.

Answer

`always_run: yes`

Answer

`ignore_errors: yes`

Answer

`run_once: true`

Question 14

An administrator maintains a static inventory file at /home/student/inventory that defines a group 'webservers' and a group 'dbservers'. A host named 'web1.example.com' must belong to both groups. Which INI snippet correctly assigns web1.example.com to both groups without creating duplicate host entries?

Accepted Answer

[webservers]
web1.example.com

[dbservers]
web1.example.com. Placing the same hostname under two separate group headers is the correct way to give a host membership in multiple groups in an INI inventory. Ansible then treats the host as a single managed node that inherits variables from both groups, with group variable precedence rules resolving conflicts.

Answer

[webservers]
web1.example.com

[dbservers]
web1.example.com ansible_group=webservers

Answer

[webservers]
web1.example.com

[dbservers]
web1.example.com:children

Answer

[webservers]
web1.example.com

[dbservers:children]
webservers

Question 15

You are preparing an Ansible playbook that will run on a managed node. The playbook includes a task that uses the `ansible.builtin.user` module to create a user. The playbook is stored in a Git repository that multiple engineers can access. You need to ensure that the password for the new user is not stored in plain text in the repository. Which Ansible feature should you use to protect the password?

Accepted Answer

ansible-vault encrypt_string. The password must not be stored in plain text in the Git repository. Using `ansible-vault encrypt_string` allows you to encrypt just the password value and include it inline in the playbook or variables file. At runtime, Ansible decrypts the string using the vault password, so the secret remains protected in version control. The other commands either encrypt entire files or manage vault keys, which do not address an inline secret.

Answer

ansible-vault create

Answer

ansible-vault encrypt

Answer

ansible-vault rekey