EX294 Practice Test 3 — 10 Questions

Question 1

Refer to the exhibit. An administrator wants to view the decrypted value of 'db_password' without modifying the file. Which command should be used?

Accepted Answer

ansible-vault view file.yml. The `ansible-vault view` command decrypts the file in memory and displays its contents to stdout without modifying the encrypted file on disk. This is the correct choice because the administrator only needs to see the decrypted value of 'db_password' and does not want to change the file.

Answer

ansible-vault rekey file.yml

Answer

ansible-vault decrypt file.yml

Answer

ansible-vault edit file.yml

Question 2

A developer wrote a custom filter plugin in a Python file `my_filters.py` and placed it in the directory `./filter_plugins/`. The playbook fails with 'ERROR! no filter named 'my_custom_filter''. The playbook is located in `/home/user/project/playbook.yml`. The `ansible.cfg` file in the same directory does not set `filter_plugins`. Which is the most likely cause?

Accepted Answer

The plugin file must be a Python module with a class named `FilterModule` and the filter function must be listed in the `filters` method. Ansible requires custom filter plugins to be Python modules that define a class named `FilterModule` with a `filters()` method returning a dictionary mapping filter names to their implementing functions. Without this structure, Ansible cannot discover or register the filter, causing the 'no filter named' error.

Answer

The filter file must be named `__init__.py`

Answer

The filter function must be imported in the playbook via `filter_plugins: my_filters`

Answer

The filter function name does not match the class name in the plugin

Question 3

Refer to the exhibit. An administrator runs an Ansible playbook and receives the error shown. The playbook uses a variable 'vault_httpd_port' that should be stored in an encrypted vault file. Which step should the administrator take first to resolve the issue?

Accepted Answer

Ensure the vault file is referenced in the playbook using include_vars or vars_files, and that the vault password is correct.. The error indicates Ansible cannot find the variable 'vault_httpd_port' because the encrypted vault file containing it is not being loaded into the playbook's variable scope. The administrator must first verify that the vault file is properly referenced via include_vars or vars_files in the playbook, and that the correct vault password is supplied (e.g., via --ask-vault-pass or a vault password file). Without loading the vault file, the variable remains undefined regardless of encryption password changes.

Answer

Re-encrypt the vault file with a different password.

Answer

Add 'vault_httpd_port' to the group_vars/all.yml file without encryption.

Answer

Use the --ask-vault-pass option again with a different password.

Question 4

Match each Ansible module to its primary function.

Accepted Answer

yum: Manages packages using the yum package manager. The yum module manages packages, service manages system services, and copy transfers files from local to remote. Common confusions include swapping definitions or using the wrong direction for file transfers.

Answer

yum: Manages services (start, stop, restart, enable)

Answer

service: Manages packages using the yum package manager

Answer

copy: Copies files from remote to local hosts

Question 5

An administrator needs to securely store a database password used across multiple roles in a shared repository. Which approach is recommended?

Accepted Answer

Use ansible-vault to encrypt the password string and store it in a file, then include_vars.. Ansible-vault encrypts sensitive data at rest using AES-256, and the encrypted file can be safely stored in a shared repository. The `include_vars` module then decrypts the file at runtime when the vault password is provided, allowing multiple roles to access the password without exposing it in plaintext.

Answer

Use a lookup plugin to fetch from a secrets manager.

Answer

Store the password in an environment variable on the controller.

Answer

Hardcode the password in the playbook and use .gitignore.

Question 6

An administrator needs to execute a role named `common` on all hosts in the play, but only for hosts that are members of the `webservers` group. Which playbook construct achieves this?

Accepted Answer

Apply the role under a play with hosts: webservers.. The most direct way to run a role only on a specific group is to target that group in the play's hosts directive. Roles run on all hosts in the play, so restricting the play's hosts restricts the role. Other options either do not filter hosts or misuse Ansible features.

Answer

Add a task with delegate_to: webservers before including the role.

Answer

Set a variable in group_vars/webservers.yml and use it in the role's tasks.

Answer

Use the roles keyword with a when condition on the group name.

Question 7

A company manages its infrastructure using Ansible Tower. There are two teams: Team Alpha manages web servers in the 'webservers' group, and Team Beta manages database servers in the 'dbservers' group. Both teams need to use the same SSH credential to connect to their respective servers. The credential is stored in Tower as 'shared_ssh_key'. Team Alpha reports that they can launch jobs against the 'webservers' group, but Team Beta gets an error when trying to launch jobs against the 'dbservers' group: 'You do not have permission to use this credential.' Both teams are members of the same organization. The inventory is a single inventory source with separate groups. The credential has been assigned to the organization. What is the most likely cause of Team Beta's issue, and what is the correct solution?

Accepted Answer

Grant Team Beta the 'Use' role on the credential 'shared_ssh_key'.. In Ansible Tower, credentials are assigned to an organization, but users or teams must be explicitly granted the 'Use' role on a credential to be able to use it in a job template. Team Alpha can use the credential because they likely have the 'Use' role, while Team Beta does not. Granting Team Beta the 'Use' role on 'shared_ssh_key' resolves the permission error.

Answer

Create a new credential with the same SSH key and assign it to Team Beta.

Answer

Assign the credential to the dbservers group in the inventory.

Answer

Move the credential from the organization to the project level.

Question 8

Consider the task: `- debug: msg={{ item | upper }}` with `loop: "{{ ['a','b'] }}"`. What will be the output?

Accepted Answer

Two debug messages: 'A' and 'B'. The `upper` filter in Ansible converts each string item in the loop to uppercase. The `loop` directive iterates over the list `['a','b']`, and for each iteration, the `{{ item | upper }}` expression applies the `upper` filter to the current item, resulting in `'A'` and `'B'`. The `debug` module then prints each transformed value as a separate message.

Answer

An error because upper expects a string, not a loop variable.

Answer

Two debug messages: 'a' and 'b'

Answer

One debug message with the list ['A','B']

Question 9

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 10

An administrator wants to reuse a set of tasks across multiple playbooks. Which Ansible approach is most appropriate?

Accepted Answer

Creating a role with tasks in tasks/main.yml.. Roles are the standard Ansible mechanism for packaging and reusing tasks, variables, handlers, and other automation content across multiple playbooks. By placing tasks in a role's `tasks/main.yml`, the administrator can reference that role in any playbook using the `roles:` directive, enabling clean, modular reuse without duplication.

Answer

Encrypting the tasks with Ansible Vault.

Answer

Using ansible-doc to document the tasks.

Answer

Writing a custom module in Python.