EX294 Practice Test 29 — 15 Questions

Question 1

The inventory above is used in a job template in Automation Controller. The job template also has a machine credential assigned that specifies username 'root' and an SSH key. When the job runs against host web1, which username will Ansible use to connect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

admin (from inventory host variable). Ansible uses a specific precedence order for determining the connection user. When a host variable (like `ansible_user: admin`) is defined in the inventory for host web1, it overrides the username set in the job template's machine credential. The credential's username ('root') acts only as a fallback if no `ansible_user` is defined at the host or group level.

Answer

The username set in the job template's 'extra variables'

Answer

The first defined username in the credential chain

Answer

root (from credential)

Question 2

Which TWO options are valid techniques for rolling out updates to a subset of hosts before updating the rest? (Choose exactly two.)

Accepted Answer

Use serial: 3 to update hosts in batches of 3.. The `serial: 3` directive in an Ansible playbook limits the number of hosts updated in each batch, allowing you to roll out changes to a subset of hosts before proceeding to the next batch. This is a native Ansible mechanism for controlling rolling updates by specifying the batch size, ensuring that only three hosts are updated at a time, with the play pausing between batches.

Answer

Use inventory host variables to mark hosts for early update and use conditional tasks.

Answer

Use the --forks=1 option to update one host at a time.

Answer

Use the 'strategy: random' directive in the playbook.

Question 3

A system administrator is troubleshooting an execution environment that fails to build. The error indicates that a required collection cannot be found. Which THREE of the following actions could resolve the issue?

Accepted Answer

Verify that the collection is listed in the 'dependencies' section of the execution-environment.yml under 'galaxy'.. The 'dependencies' section under 'galaxy' in the execution-environment.yml file is the standard mechanism for declaring required Ansible collections. When the execution environment is built, ansible-builder reads this section and automatically installs the listed collections from the configured Galaxy server. If a required collection is missing, verifying its presence in this section ensures it will be included in the build.

Answer

Add the collection to the 'additional_build_steps' section with a manual 'ansible-galaxy collection install' command.

Answer

Include the collection in the 'build_ignore' list to skip it.

Question 4

An organization has multiple automation controller clusters spread across different geographic regions. The security policy requires that job artifacts (such as logs and assets) must remain in the region where the job ran. Which THREE configurations support this requirement? (Choose exactly three.)

Accepted Answer

Disable the 'Enable remote logging' option in the controller configuration for each cluster.. Disabling 'Enable remote logging' in the controller configuration ensures that job artifacts (logs, assets) are stored locally on the controller's filesystem rather than being forwarded to an external logging server. This directly enforces the regional data residency requirement by preventing artifacts from leaving the geographic region where the controller cluster resides.

Answer

Use a custom execution environment that writes artifacts to a network share.

Answer

Configure automation mesh to route jobs to the nearest execution node.

Question 5

A junior administrator needs to rotate the password for a database user stored in an Ansible Vault-encrypted file (secrets.yml). The current password is unknown to the admin, but they have the vault password file (vault-pass.txt). The admin wants to edit the file securely without exposing the decrypted content in the terminal history or logs. Which command should they run?

Accepted Answer

ansible-vault edit --vault-password-file vault-pass.txt secrets.yml. `ansible-vault edit` decrypts the file to a temporary file, opens it in the default editor (e.g., vi), and upon saving, re-encrypts it transparently. This prevents the decrypted content from ever being written to the terminal history or logs, as the editing happens in a secure temporary location that is cleaned up after the editor closes.

Answer

ansible-vault decrypt --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault rekey --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault view --vault-password-file vault-pass.txt secrets.yml

Question 6

Which THREE of the following are valid uses of the 'ansible.builtin.include_role' module?

Accepted Answer

Pass variables to the included role using the 'vars' keyword.. The 'ansible.builtin.include_role' module supports the 'vars' keyword to pass variables directly to the included role. This allows you to override or supply role variables at the point of inclusion, which is a common pattern for reusing roles with different configurations.

Answer

Dynamically set the role name using a variable without the 'name' parameter.

Answer

Apply tags to all tasks within the included role.

Question 7

An Ansible automation engineer is developing a role that manages a microservice. The role needs to include conditional tasks based on whether a variable `microservice_version` is defined. If defined, it should use that version; otherwise, it should default to `latest`. Which of the following is the most efficient and idiomatic way to implement this default value within the role?

Accepted Answer

In the task: `image: "myimage:{{ microservice_version | default('latest') }}"`. It uses the `default` filter directly in the task to set a fallback value for `microservice_version` when it is undefined. This is the most efficient and idiomatic approach in Ansible, as it avoids modifying role defaults or introducing extra variables, and it handles the conditional logic inline without unnecessary complexity.

Answer

In `defaults/main.yml`: `microservice_version: latest` and reference `{{ microservice_version }}` in the task.

Answer

In the task: `image: "myimage:{{ microservice_version }}"` and use `| mandatory` to fail if undefined.

Answer

In the task: `vars: microservice_version: "{{ microservice_version | default('latest') }}"`

Question 8

A DevOps engineer is creating an execution environment for a team that needs both Ansible and the 'requests' Python library. The engineer creates an execution environment definition file (EE.yml) with the following content:
---
version: 3
images:
  base_image:
    name: registry.redhat.io/ansible-automation-platform-22/ee-minimal-rhel8:latest
options:
  package_manager_path: /usr/bin/microdnf
dependencies:
  python: requirements.txt
  system: bindep.txt

What is missing from this definition to ensure the 'requests' library is installed?

Accepted Answer

The requirements.txt file must contain 'requests'.. The execution environment definition file (EE.yml) specifies dependencies via external files like requirements.txt for Python packages. To install the 'requests' library, the requirements.txt file must explicitly list 'requests' as a dependency. Without it, the build process will not include the library, regardless of other configuration options.

Answer

The package_manager_path should be /usr/bin/yum.

Answer

The galaxy.yml file must be added to the dependencies section.

Answer

The base image should be ee-supported-rhel8 instead.

Question 9

Which ansible.cfg setting controls the number of parallel forks for task execution?

Accepted Answer

forks. The `forks` setting in `ansible.cfg` (or the `ANSIBLE_FORKS` environment variable) controls the maximum number of parallel processes Ansible uses when executing tasks on remote hosts. By default, this value is 5, meaning Ansible will manage up to 5 hosts concurrently per playbook run. Increasing this value allows Ansible to operate on more hosts simultaneously, improving throughput in larger environments.

Answer

parallel

Answer

max_parallel

Answer

threads

Question 10

An administrator needs to create a custom execution environment that includes a specific Ansible collection and a Python package. Which two steps are required to build and use the execution environment? (Choose two.)

Accepted Answer

Build the execution environment using ansible-builder.. `ansible-builder` is the official tool for building Ansible execution environments, which are container images that bundle Ansible, collections, and dependencies. It uses a definition file (execution-environment.yml) to specify collections and Python packages, then builds the container image. Option E is correct because a `requirements.yml` file is the standard way to list Ansible collections for inclusion in an execution environment, and `ansible-builder` reads this file during the build process.

Answer

Create a Dockerfile that installs the collection and package.

Answer

Define the execution environment in ansible.cfg.

Answer

Push the execution environment to a private container registry.

Question 11

Refer to the exhibit. An automation job failed with the given error. What is the most likely cause?

Accepted Answer

The SSH key is not authorized for the remote user. The error message indicates an SSH authentication failure, which occurs when the SSH key presented by the control node is not authorized for the remote user's account. This is the most likely cause because Ansible relies on SSH key-based authentication by default, and a missing or mismatched public key on the remote host will prevent the connection.

Answer

The playbook syntax is incorrect

Answer

The SSH port is blocked

Answer

The remote host is unreachable

Question 12

Refer to the exhibit. Assuming the managed node is RHEL 7.9, what is the output of the debug task?

Accepted Answer

True. The debug task uses the `debug` module with `msg: "{{ ansible_distribution_version is version('7.9', '>=') }}"`. The `version` filter compares the string `'7.9'` (from `ansible_distribution_version`) against the string `'7.9'` using the `>=` operator. Since the managed node is RHEL 7.9, the comparison evaluates to `True`, so the debug module outputs `True`.

Answer

7.9

Answer

An error

Answer

False

Question 13

An administrator needs to store a secret API token in Ansible Automation Controller so that it can be used in job templates without exposing the token in plain text. Which type of credential should be used?

Accepted Answer

Vault credential. A Vault credential in Ansible Automation Controller stores an encrypted password that can be used to decrypt Ansible Vault files. While originally designed for vault files, it can also be used to securely store any secret, such as an API token, by referencing it via the {{ vault_password }} variable in job templates. This ensures the token is never exposed in plain text. Machine credentials are for SSH authentication, Network credentials for network devices, and Cloud credentials for cloud provider APIs—none are suitable for storing arbitrary API tokens.

Answer

Machine credential

Answer

Network credential

Answer

Cloud credential

Question 14

A security team requires that all passwords in an Ansible vault be encrypted with a different key from the host variables. They want to use a custom lookup plugin that fetches secrets from an external API. Which plugin type should be developed?

Accepted Answer

Lookup plugin. A lookup plugin is the correct choice because it is designed to retrieve data from external sources (like an API) and return it as a string or list for use in Ansible playbooks. This aligns with the requirement to fetch secrets from an external API, and lookup plugins can be used directly in variables or templates without modifying the host state.

Answer

Module

Answer

Action plugin

Answer

Filter plugin

Question 15

Which TWO elements can be used to include external task files in a playbook?

Accepted Answer

import_tasks. Both `import_tasks` and `include_tasks` are Ansible directives used to incorporate external task files into a playbook. `import_tasks` statically loads and parses the tasks at playbook parse time, meaning all tasks are treated as if they were written directly in the playbook. `include_tasks` dynamically loads tasks at runtime, allowing for conditional includes and loops that are evaluated when the task is executed.

Answer

include_vars

Answer

add_host

Answer

include_role