EX294 Practice Test 31 — 15 Questions

Question 1

A playbook uses the 'include_tasks' module to dynamically include tasks based on a variable. The playbook runs successfully on some hosts but fails on others with a 'template error' message. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The variable used in the 'include_tasks' path has a Jinja2 template error.. The 'include_tasks' module dynamically resolves the path to a task file using a variable. If that variable contains a Jinja2 template error (e.g., undefined variable, syntax mistake, or filter misuse), Ansible will fail with a 'template error' message during the variable expansion phase, before the task file is even loaded. This explains why the error occurs only on hosts where the variable's value or context triggers the template failure.

Answer

The included task file does not exist on the control node.

Answer

The included task file has incorrect permissions.

Answer

The included tasks contain a syntax error.

Question 2

An organization has multiple Ansible Tower projects that use different cloud providers. The security team mandates that cloud API credentials stored in Tower must have restricted access and be reusable across job templates without exposing the secret key. Which credential type and organization strategy best meets these requirements?

Accepted Answer

Create separate custom credential types for each cloud provider, marking the secret key fields as 'password' type, and add them to each job template as needed.. Ansible Tower's custom credential types allow you to define fields with the 'password' type, which encrypts the secret key and hides it from view after entry. By creating separate custom credential types for each cloud provider, you can assign them to specific job templates, ensuring restricted access and reusability without exposing the secret key. This approach meets the security mandate by isolating credentials per provider and leveraging Tower's built-in encryption for sensitive fields.

Answer

Use a network credential to store the API token and assign it to the project.

Answer

Create a single custom credential type that includes both cloud provider API keys and reuse it across all projects.

Answer

Use a machine credential for each cloud provider and set the SSH key as the API secret.

Question 3

A playbook uses the 'debug' module to print a variable 'my_var' but the output is 'VARIABLE IS UNDEFINED'. The variable is defined in group_vars/all.yml. Which filter could be used to provide a default value and avoid this error?

Accepted Answer

{{ my_var | default('fallback') }}. The `default` filter in Ansible provides a fallback value when a variable is undefined, preventing the 'VARIABLE IS UNDEFINED' error. Using `{{ my_var | default('fallback') }}` ensures that if `my_var` is not defined in group_vars/all.yml or any other precedence level, the string 'fallback' is used instead of causing a failure.

Answer

Answer

Answer

Question 4

An administrator wants to reuse a set of tasks across multiple playbooks. Which Ansible approach is most appropriate?

Accepted Answer

Creating a role with tasks in tasks/main.yml.. Roles are the standard Ansible mechanism for packaging and reusing tasks, variables, handlers, and other automation content across multiple playbooks. By placing tasks in a role's `tasks/main.yml`, the administrator can reference that role in any playbook using the `roles:` directive, enabling clean, modular reuse without duplication.

Answer

Encrypting the tasks with Ansible Vault.

Answer

Using ansible-doc to document the tasks.

Answer

Writing a custom module in Python.

Question 5

An administrator wants to update a web server fleet with minimal downtime. They need to update each server one at a time. Which Ansible playbook directive should be used?

Accepted Answer

serial: 1. The `serial: 1` directive in an Ansible playbook controls the batch size of hosts that are updated simultaneously. Setting it to 1 ensures that only one host is updated at a time, which minimizes downtime by allowing the rest of the fleet to remain available while each server is sequentially updated.

Answer

throttle: 1

Answer

forks: 1

Answer

max_fail_percentage: 0

Question 6

Match each Ansible fact variable to its description.

Accepted Answer

ansible_distribution: The name of the operating system distribution (e.g., RedHat, Ubuntu). The correct matches are: ansible_distribution -> OS distribution name, ansible_os_family -> OS family, ansible_architecture -> CPU architecture. Common confusions include mistaking memory units (MB vs GB) and hostname vs IP address.

Answer

ansible_memtotal_mb: Total memory in gigabytes

Answer

ansible_hostname: The IP address of the managed node

Question 7

Match each Ansible inventory parameter to its meaning.

Accepted Answer

ansible_host: The hostname or IP address to connect to.. Common Ansible inventory parameters: ansible_host defines target host, ansible_port defines SSH port, ansible_user defines remote user, ansible_ssh_private_key_file defines SSH key. Be careful not to confuse them with ansible_connection or ansible_become.

Answer

ansible_host: The connection type (e.g., ssh, winrm).

Answer

ansible_port: The method to become a different user (e.g., sudo).

Question 8

An organization uses ansible-builder to create an execution environment (EE) for network automation. The EE includes a custom collection 'acme.network' that requires the 'netaddr' Python library. The ansible-builder definition file (execution-environment.yml) lists 'netaddr' in the requirements.txt under dependencies.python. After building the EE and pushing it to the local registry, a user runs ansible-navigator with the EE and executes a playbook that uses a module from 'acme.network'. The playbook fails with an error that 'netaddr' is not installed. The user checks the running container and confirms that 'netaddr' is installed via pip list. What is the most likely cause?

Accepted Answer

The Python environment in the EE has multiple versions and netaddr is installed in the wrong one.. Execution environments built with ansible-builder can contain multiple Python interpreters (e.g., system Python and a virtual environment). The 'netaddr' library might be installed in the system Python but the Ansible controller process inside the EE runs from a different Python environment (often a virtual environment under /usr/share/ansible). When the playbook executes, it imports from the wrong Python, causing the 'not installed' error despite pip list showing the package.

Answer

The base image for the EE does not include the required system packages for 'netaddr'.

Answer

The collection 'acme.network' is not installed in the EE.

Answer

The ansible-navigator command is using a different EE than the one built.

Question 9

An administrator needs to restrict access to an inventory so that only members of the 'WebTeam' can update its host variables and group memberships. Other users should be able to view the inventory but not modify it. Which role-based access control (RBAC) configuration should be applied?

Accepted Answer

Assign the 'WebTeam' the 'admin' role on the inventory and others the 'read' role. In Ansible Tower/AWX, the 'admin' role on an inventory grants full update permissions (including host variables and group memberships), while the 'read' role provides view-only access. This directly satisfies the requirement that only WebTeam members can modify the inventory, and others can only view it.

Answer

Create a job template and assign 'WebTeam' the 'execute' role

Answer

Make the 'WebTeam' organization administrators and assign others the 'read' role on the organization

Answer

Assign the 'WebTeam' the 'use' role on the inventory and others the 'read' role

Question 10

Refer to the exhibit. After running the playbook, the 'content' field contains an HTML page. The team wants to extract the text inside the

tags using Ansible filters. Which of the following tasks correctly extracts the content of the

element?

Accepted Answer

set_fact: heading="{{ result.content | regex_replace('.*

(.*)

.*', '\1') }}". It uses `regex_replace` with a pattern that matches the entire string (`.*

(.*)

.*`) and replaces it with the captured group `\1`, effectively extracting only the heading text. Option B, while it uses `regex_replace`, only matches the `

...

` portion; if the page contains any content outside the `

` tags, that content remains, so it does not reliably extract just the heading text. Options C and D return the full match including the tags, not just the inner text.

Answer

set_fact: heading="{{ result.content | regex_replace('

(.*)

', '\1') }}"

Answer

set_fact: heading="{{ result.content | regex_search('

(.*)

') }}"

Answer

set_fact: heading="{{ result.content | regex_findall('

(.*)

') | first }}"

Question 11

Which command runs a playbook using an execution environment named 'my-ee'?

Accepted Answer

ansible-navigator run playbook.yml --execution-environment my-ee. Both Option A and Option D are correct because `ansible-navigator run` supports both the full flag `--execution-environment` and its shorthand `--ee` to specify an execution environment. Option A uses the full flag, while Option D uses the shorthand; both are valid. Options B and C are incorrect because `ansible-playbook` does not support execution environments directly, and `ansible-runner` is a different tool typically used in automation controller environments, not directly for running playbooks with execution environments in the same manner.

Answer

ansible-playbook -i inventory playbook.yml -e 'ansible_python_interpreter=/usr/bin/python3' --ee my-ee

Answer

ansible-runner run --ee my-ee playbook.yml

Question 12

A playbook uses ansible.builtin.import_playbook to include other playbooks. The administrator needs to pass variables to the imported playbook. Which approach is valid?

Accepted Answer

Add a 'vars' block to the import_playbook statement. `ansible.builtin.import_playbook` supports a `vars` keyword directly in the import statement, allowing you to pass variables to the imported playbook at the time of import. This is the only built-in method that passes variables into the imported playbook's scope without relying on external files or facts.

Answer

Use ansible.builtin.include_vars inside the imported playbook

Answer

Set variables using set_fact before the import

Answer

Use group_vars or host_vars

Question 13

An administrator wants to ensure a role's tasks are executed only on certain hosts. Which approach should they use?

Accepted Answer

Use a 'when' condition in the role's tasks. Ansible's 'when' clause allows conditional execution of tasks based on variables such as inventory hostname, group membership, or custom facts. By using a 'when' condition that checks the target host's identity (e.g., 'ansible_hostname' or 'inventory_hostname'), the administrator can ensure that the role's tasks run only on specific hosts, without modifying inventory structure or using separate variable files.

Answer

Set host_vars for each target host

Answer

Set group_vars for the target group

Answer

Use tags on the role

Question 14

An Ansible role has a complex dependency tree. The administrator wants to ensure that dependencies are installed before the main role tasks. Which file should be used to define dependencies?

Accepted Answer

meta/main.yml. In Ansible, role dependencies are defined in the `meta/main.yml` file using the `dependencies` key. This ensures that any listed roles are executed before the main role's tasks, providing a controlled execution order. The `meta/main.yml` file is specifically designed for metadata such as dependencies, author information, and supported platforms.

Answer

defaults/main.yml

Answer

tasks/main.yml

Answer

vars/main.yml

Question 15

An administrator is writing a playbook to manage multiple web servers. The playbook uses a variable "server_facts" which is a list of dictionaries with keys "hostname", "ip", and "status". The administrator needs to extract a list of all hostnames where status is "online". The administrator writes:

- name: Get online hosts
  set_fact:
    online_hosts: "{{ server_facts | selectattr('status', '==', 'online') | map(attribute='hostname') | list }}"

However, when running the playbook, the "selectattr" filter fails with an error: "Invalid data passed to filter". The administrator checks the structure of "server_facts" and confirms it is a list of dicts with the expected keys. What is the most likely cause of the error?

Accepted Answer

The "status" key exists but its value is not consistently a string; some entries have integer 0/1 instead of "online"/"offline".. The `selectattr` filter in Ansible uses Jinja2's `selectattr` which relies on Python's `attrgetter` and comparison operators. If the `status` key exists but its value is not consistently a string (e.g., some entries have integer 0/1 instead of 'online'/'offline'), the equality comparison `'==', 'online'` will fail because an integer cannot be compared to a string in this context, causing an 'Invalid data passed to filter' error. The administrator confirmed the structure is correct, so the issue is likely a type mismatch in the values.

Answer

The "map" filter cannot be chained with "selectattr" directly.

Answer

The "list" filter is unnecessary and causes the error.

Answer

The "selectattr" filter requires Python 3.8 or later.