EX294 Practice Test 30 — 15 Questions

Question 1

Which TWO statements about Ansible Execution Environments (EE) are true?

Accepted Answer

Execution environments are container images built with ansible-builder.. Execution environments are container images that package Ansible Core, collections, and Python dependencies, and they are built using the `ansible-builder` tool. The `ansible-builder` reads a definition file (e.g., `execution-environment.yml`) to construct a container image that includes all necessary components for running Ansible automation in a consistent, isolated environment.

Answer

Execution environments are primarily used for developing new Ansible modules.

Answer

Execution environments use ansible-navigator as the default entrypoint.

Answer

Execution environments can only be used with the ansible-navigator command-line tool.

Question 2

A team is using Ansible Tower with multiple credentials per job template. The playbook uses the 'become' method to escalate privileges on remote hosts. The become password is different from the SSH password. Which configuration ensures the become password is used?

Accepted Answer

Provide both the SSH password and become password in the machine credential.. In Ansible Tower, when a job template uses multiple credentials, the machine credential is the primary credential for SSH authentication. To use a different become password, you must provide both the SSH password and the become password within the same machine credential. This is because the machine credential has dedicated fields for 'Password' (SSH) and 'Become Password' (privilege escalation), and Tower automatically uses the become password from that credential when the playbook invokes 'become: yes'.

Answer

Use a vault credential to store the become password.

Answer

Use two separate credentials (one for SSH, one for become) and assign both to the job template.

Answer

Store the become password in inventory variables.

Question 3

A junior admin is troubleshooting why a job template fails with 'Permission denied' when connecting to a target host. The job template uses a machine credential that appears correct. What is the first thing to check?

Accepted Answer

Check the credential's username and private key / password. The error 'Permission denied' during SSH connection to a target host indicates an authentication failure. Since the machine credential appears correct, the most immediate cause is that the username or private key/password stored in the credential is incorrect or mismatched. This is the first thing to check because the credential directly controls authentication to the target host.

Answer

Verify the inventory contains the correct host IP

Answer

Check the vault credential used in the job template

Answer

Check the project sync status

Question 4

A junior admin is tasked with creating a playbook that sets a variable 'app_status' to 'starting' if a service file exists, otherwise sets it to 'stopped'. Which filter should be used to test if a file exists from Ansible facts?

Accepted Answer

file. The `file` test in Jinja2 checks whether a path exists as a file, returning a boolean. It can be used directly in `when` conditions like `when: mypath is file`. Option B is incorrect because there is no built-in `exists` filter in Ansible; the `exists` attribute comes from the `stat` module result, not a filter. The junior admin should use the `file` test or the `stat` module with its `exists` attribute.

Answer

path

Answer

exists

Answer

is_dir

Question 5

Which filter converts a string like 'hello' into a list of characters ['h','e','l','l','o']?

Accepted Answer

`list`. The `list` filter in Ansible converts a string into a list of its individual characters by iterating over the string and creating a list where each element is a single character. This is a built-in Jinja2 filter that works directly on strings, making option A correct for transforming 'hello' into ['h','e','l','l','o'].

Answer

`split`

Answer

`join`

Answer

`map`

Question 6

Which THREE directives can be used to modify loop behavior in Ansible?

Accepted Answer

ignore_errors. A is correct because `ignore_errors` is a directive that modifies loop behavior by allowing the task to continue processing subsequent items in the loop even if one iteration fails. This is commonly used when you want to gather information from multiple hosts or resources and don't want a single failure to halt the entire loop execution.

Answer

rescue

Answer

always

Question 7

Which TWO statements about Ansible roles are correct?

Accepted Answer

Roles must follow a specific directory structure.. Ansible roles enforce a specific directory structure (e.g., tasks/, handlers/, templates/, files/, vars/, defaults/, meta/, and library/) to organize automation content. This structure is mandatory for Ansible to correctly locate and load role components during playbook execution.

Answer

Ansible Galaxy is a continuous integration tool for testing roles.

Answer

Role dependencies must be defined in a file named dependencies.yml.

Answer

Role names must have a .role extension.

Question 8

An Ansible playbook sets a variable with a dictionary value in the play's vars and also in group_vars/all. When the play runs, the dictionary in group_vars completely replaces the one in play vars. What is the most likely reason?

Accepted Answer

Ansible's default variable precedence uses replacement, not merging, for dictionaries. Ansible's default variable precedence treats dictionaries as atomic values: when a dictionary variable is defined at a higher precedence level (like group_vars), it completely replaces the same variable defined at a lower precedence level (like play vars). Ansible does not merge dictionaries by default; the `hash_behaviour` setting, which controls merging, defaults to `replace`. Option A is incorrect because `set_fact` has a higher precedence than group_vars, but the question describes group_vars replacing play vars, which is normal precedence behavior, not set_fact. Option B is incorrect because YAML syntax is not the issue; even with correct syntax, replacement occurs. Option C is incorrect because the same variable name is used, leading to replacement rather than merging.

Answer

the playbook uses 'set_fact' which overrides all other vars

Answer

the play vars dictionary is defined with incorrect YAML syntax

Answer

the group_vars file uses a different variable name

Question 9

A team uses Ansible AWX and needs to run a job template that uses a custom credential of type 'OpenStack' to authenticate to an OpenStack cloud. Which field in the job template is used to specify this credential?

Accepted Answer

Credential. In Ansible AWX, the 'Credential' field in a job template is used to specify the primary credential for authentication to external systems. When using a custom credential type like 'OpenStack', selecting it in the 'Credential' field associates the job template with the OpenStack authentication parameters (e.g., auth URL, username, password, project) defined in that credential. This allows the job to authenticate to the OpenStack cloud during execution.

Answer

Custom Credential

Answer

Extra Credentials

Answer

Machine credential

Question 10

An administrator needs to limit the number of concurrent jobs that can run on a specific automation controller node. Which setting should be adjusted?

Accepted Answer

The max concurrent jobs setting in the node's configuration. The correct setting to limit concurrent jobs on a specific automation controller node is the 'max concurrent jobs' parameter in the node's configuration. This setting directly controls how many jobs the node can execute simultaneously, preventing resource exhaustion and ensuring predictable performance. Adjusting this value is the proper method for managing node-level concurrency in Red Hat Ansible Automation Platform.

Answer

The forks parameter in the playbook

Answer

The job template's 'allow simultaneous' option

Answer

The number of execution environments

Question 11

A system administrator wants to publish a custom Ansible collection to a private Automation Hub. What is the correct command to build the collection before publishing?

Accepted Answer

ansible-galaxy collection build. `ansible-galaxy collection build` is the command that compiles the collection directory into a distributable tarball (e.g., `mycollection-1.0.0.tar.gz`), which is the required artifact for publishing to a private Automation Hub. Without this build step, there is no archive to upload.

Answer

ansible-galaxy collection init mycollection

Answer

ansible-galaxy collection publish ./mycollection-1.0.0.tar.gz

Answer

ansible-galaxy collection install .

Question 12

An organization uses Automation Controller with multiple teams. They want to ensure that team members can only launch job templates that are explicitly assigned to their team. Which configuration approach should be used?

Accepted Answer

Create roles and assign them at the job template level using team roles. Automation Controller (formerly Ansible Tower) uses Role-Based Access Control (RBAC) where roles (e.g., Execute, Admin) can be assigned to teams at the job template level. This ensures that only members of a specific team can launch the job templates explicitly assigned to that team, without affecting other teams or requiring organization-wide permissions.

Answer

Assign each team to an organization and set organization-level permissions

Answer

Set 'allow simultaneous' to false on job templates

Answer

Use an Identity Provider (IdP) to restrict access

Question 13

A team develops a custom Ansible role 'webserver' that depends on another role 'common'. They want to ensure that when 'webserver' is used, 'common' is automatically installed from the same Galaxy server. Which approach should they use?

Accepted Answer

Add a dependencies: ['common'] to the role's meta/main.yml file.. Ansible roles can declare dependencies in the `meta/main.yml` file using the `dependencies` key. When the 'webserver' role is installed via `ansible-galaxy install`, Ansible automatically resolves and installs all listed dependencies from the same Galaxy server, ensuring 'common' is present without manual intervention.

Answer

Add a requirements.yml file in the role's root directory specifying common.

Answer

Use ansible-galaxy install webserver --with-dependencies to install common separately.

Answer

Include the 'common' role in the playbook before 'webserver'.

Question 14

A developer wants to reuse a set of tasks that conditionally include other task files based on variables defined per host. Which method should be used to ensure the included tasks are evaluated per host at runtime?

Accepted Answer

include_tasks. Include_tasks, because it dynamically loads and evaluates task files at runtime, allowing conditional logic and per-host variables to be resolved when the tasks are executed. This is essential for reusing a set of tasks that conditionally include other task files based on variables defined per host, as include_tasks processes the included file fresh each time it is encountered, respecting any host-specific variable context.

Answer

include_role

Answer

import_role

Answer

import_tasks

Question 15

An administrator wants to reuse a set of tasks that configure a firewall across multiple playbooks. Which Ansible feature should be used to achieve this?

Accepted Answer

Create a role for firewall configuration.. A role is the correct Ansible feature for reusing a set of tasks across multiple playbooks. Roles provide a structured, self-contained directory layout for tasks, handlers, variables, templates, and files, allowing the firewall configuration logic to be packaged once and referenced in any playbook via the `roles:` directive or `import_role`/`include_role` modules.

Answer

Add the tasks to the inventory file under a group.

Answer

Define the tasks in a vars file and include it.

Answer

Define the tasks as handlers and notify them.