EX294 Practice Test 32 — 15 Questions

Question 1

You have an Ansible playbook that uses the 'lineinfile' module to manage the /etc/ssh/sshd_config file. The playbook runs without errors, but after execution, the SSH service becomes unreachable on some hosts. Investigation reveals that the file contains duplicate lines for 'Port 22' and 'PermitRootLogin no'. The playbook uses the following task:

- name: Ensure SSH settings
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^{{ item.key }}"
    line: "{{ item.key }} {{ item.value }}"
  loop:
    - { key: 'Port', value: '22' }
    - { key: 'PermitRootLogin', value: 'no' }

The playbook is run multiple times. What is the most likely cause of the duplicate lines?

Accepted Answer

The regexp pattern does not match the existing lines exactly, causing new lines to be added instead of replacing.. The regexp pattern `^{{ item.key }}` matches only the start of a line (e.g., `^Port` or `^PermitRootLogin`), but the existing lines in `/etc/ssh/sshd_config` may have leading spaces or tabs (common in SSH config files). Since the regex does not match the actual line due to whitespace, the `lineinfile` module inserts a new line instead of replacing the existing one. Each playbook run adds another duplicate, eventually causing SSH to fail due to conflicting directives.

Answer

The 'lineinfile' module is not idempotent when used with loops.

Answer

The loop should use 'with_items' instead of 'loop' for proper idempotence.

Answer

The 'line' parameter should use backreferences to avoid duplication.

Question 2

An Ansible playbook repeatedly uses the same pattern: check if a service is running, if not start it, and then verify it's running. Which three Ansible features can be used to reduce code duplication? (Choose three.)

Accepted Answer

Using a role with multiple tasks and handlers.. Options B and E are correct because roles (with tasks and handlers) and include_tasks with loops are the proper mechanisms for reusing task patterns in Ansible. Option D is incorrect: custom filter plugins are used for data transformation in templates, not for encapsulating task execution logic. include_vars (A) only reuses variables, and debug (C) only outputs messages; neither reduces code duplication for the described check-start-verify pattern.

Answer

Using 'include_vars' to reuse variable files.

Answer

Using 'debug' module to output the status.

Answer

Creating a custom filter plugin to encapsulate the logic.

Question 3

An OpenShift deployment is stuck in a degraded state after a rolling update. Which command helps diagnose the root cause by showing status conditions?

Accepted Answer

oc describe deployment/myapp. `oc describe deployment/myapp` displays the full status conditions of the Deployment, including `Progressing`, `Available`, and `ReplicaFailure` conditions. When a rolling update leaves the Deployment in a degraded state, the `Conditions` field under `Status` explicitly shows the reason (e.g., `ProgressDeadlineExceeded` or `MinimumReplicasUnavailable`), which directly points to the root cause of the degradation.

Answer

oc rollout history

Answer

oc get pods

Answer

oc logs deployment/myapp

Answer

oc get events

Question 4

There are 5 hosts in the webservers group. All updates succeed on the first batch of 2 hosts. On the second batch, one host fails. What is the result?

Accepted Answer

The play aborts due to max_fail_percentage being exceeded.. Assuming the default max_fail_percentage of 0% (or a low threshold), the failure of one host in the second batch causes the cumulative failure percentage to exceed the allowed limit. Since the threshold is exceeded, the play aborts, making option D correct. Option E suggests an immediate abort, but the abort is specifically due to max_fail_percentage being exceeded.

Answer

The play retries the failed host automatically.

Answer

The play marks the host as failed and continues with the next batch.

Answer

The play continues with the remaining 1 host in the third batch.

Answer

The play aborts immediately after the failure.

Question 5

A large enterprise manages its infrastructure with Ansible Automation Platform. The operations team reports that job runs are taking longer than expected, especially for playbooks that include role dependencies. After investigation, they notice that the control node has high CPU and memory usage during job execution. The inventory contains 500 hosts, and the playbooks use several roles that include dynamic includes (include_tasks) based on conditional variables. The team wants to reduce the load on the control node without changing the playbook logic or reducing functionality. Which action should the team take?

Accepted Answer

Enable pipelining in ansible.cfg by setting pipelining = True.. Enabling pipelining reduces the number of SSH connections Ansible makes to each host by combining multiple task operations into a single SSH session. This drastically lowers the overhead on the control node's CPU and memory, especially when executing many tasks with dynamic includes across a large inventory, without altering playbook logic.

Answer

Use the --limit flag to run the playbook against a subset of hosts.

Answer

Increase the forks value in ansible.cfg to 100 to speed up execution.

Answer

Migrate to AWX to distribute job execution across multiple nodes.

Question 6

Refer to the exhibit. After running the playbook, the admin checks /etc/ssh/sshd_config and finds that the MaxAuthTries line is unchanged. What is the most likely cause?

Accepted Answer

The regexp pattern is incorrect and does not match the current configuration. The lineinfile regexp does not match any existing line, and the module does not add it if not found.

Answer

The playbook needs become: yes to modify the file

Answer

The handler was not notified because the task did not report 'changed'

Answer

The service name should be 'sshd' not 'sshd'

Question 7

A company has deployed Ansible Automation Platform with a single automation controller node. The operations team uses a workflow that includes three job templates: A, B, and C, each requiring different credentials. Recently, the workflow started failing intermittently with errors such as 'Timeout' and 'Connection refused' on certain hosts. The inventory is dynamic from a cloud provider. The administrator checks that the credentials are valid and the hosts are online. The job execution history shows that the failures occur only when the workflow attempts to run job template B on a subset of hosts that are located in a different subnet. Job templates A and C run fine on all hosts. What is the most likely cause and the best course of action?

Accepted Answer

The hosts in the problematic subnet are not reachable due to a firewall; add those hosts to a separate inventory and use a different cloud credential.. The errors 'Connection refused' and 'Timeout' on a subset of hosts for only one job template suggest a network‑level issue specific to that template’s communication path. A firewall rule blocking the port or IP used by job template B (potentially a non‑default SSH port or a different route due to its credential) is the most likely cause. Adding the affected hosts to a separate inventory with a different cloud credential can force Ansible to use an alternative network path or gateways, bypassing the restriction. Simply installing a second controller node does not explain why templates A and C succeed on the same hosts.

Answer

The credential used by job template B is associated with an incorrect SSH key for those hosts; create a new credential for that subnet and update the job template.

Answer

The automation controller does not have network access to the problematic subnet; install a second automation controller node in that subnet and configure clustering.

Answer

The job template B requires a sudo escalation that is not configured on those hosts; update the playbook to use become_method: su.

Question 8

Refer to the exhibit. A playbook fails with the given error. What is the most likely cause?

Accepted Answer

The vault password file is missing or incorrect.. The error message indicates that Ansible cannot decrypt the vault file because the vault password is missing or incorrect. This is most commonly caused by an incorrect or missing vault password file. Option A (syntax error) and option D (unreachable host) would produce different error messages. Option C (encrypted inventory file) is not a standard Ansible behavior; inventory files are typically not encrypted. Therefore, the correct answer is B.

Answer

The playbook syntax is wrong.

Answer

The inventory file is encrypted.

Answer

The remote host is unreachable.

Question 9

An Ansible Tower administrator notices that a job template fails intermittently with a 'Host unreachable' error for a specific group of servers. The inventory is static and the host entries have correct IPs. The credential used for SSH is a machine credential with a username and password, and it works for other hosts. Upon checking the job output, the error occurs during the 'Gathering Facts' step. The SSH service on these servers is running and reachable from the Tower node. What is the most likely cause?

Accepted Answer

The credential's SSH private key has a passphrase that is not stored in the credential.. The error occurs during the 'Gathering Facts' step, which uses SSH to connect to the managed hosts. If the SSH private key has a passphrase that is not stored in the credential, Ansible Tower cannot decrypt the key to authenticate, causing a 'Host unreachable' error even though the host is actually reachable. The credential works for other hosts only if those hosts are configured to accept password-based authentication, but the failing hosts may require key-based authentication, exposing the missing passphrase.

Answer

The credential type should be 'network' instead of 'machine' for these servers.

Answer

The inventory group has hosts defined with incorrect hostnames in the ansible_host variable.

Answer

The SSH service on these servers is bound to a different port than the default 22.

Question 10

An Ansible automation is used to manage firewall rules on a set of Linux servers. The playbook defines a variable "allow_rules" as:
allow_rules:
  - proto: tcp
    dport: 80
    comment: HTTP
  - proto: tcp
    dport: 443
    comment: HTTPS

The engineer needs to use the "iptables" module to create rules. The module expects "chain" to be specified, and the engineer wants to dynamically set the chain based on the port: ports 80 and 443 go to "INPUT" chain, while others go to "FORWARD". The engineer writes a loop:
- name: Add iptables rules
  iptables:
    chain: "{{ item.dport | map('some_filter') }}"
    protocol: "{{ item.proto }}"
    destination_port: "{{ item.dport }}"
    comment: "{{ item.comment }}"
  loop: "{{ allow_rules }}"

But this fails because the chain field expects a string, not a list. The engineer realizes the map filter returns a list. Which of the following modifications correctly sets the chain based on port number?

Accepted Answer

chain: "{{ (item.dport in [80,443]) | ternary('INPUT', 'FORWARD') }}". It uses the `ternary` filter to evaluate a condition (`item.dport in [80,443]`) and return 'INPUT' if true, or 'FORWARD' if false. This produces a single string, which is exactly what the `chain` parameter expects, avoiding the list output from `map`.

Answer

chain: "{{ item.dport | regex_replace('^(80|443)$', 'INPUT') | default('FORWARD', true) }}"

Answer

chain: "{{ item.dport | select('in', [80,443]) | list | first | default('FORWARD') }}"

Answer

chain: "{{ item.dport | replace('80','INPUT') | replace('443','INPUT') | default('FORWARD') }}"

Question 11

Which two actions are appropriate when configuring a custom execution environment for an automation controller job? (Choose two.)

Accepted Answer

Building the execution environment using ansible-builder. `ansible-builder` is the official tool for building custom execution environments, which are container images that include Ansible, collections, and dependencies needed for automation controller jobs. Option E is correct because a Containerfile (or Dockerfile) defines the base image, packages, and Python dependencies required for the custom execution environment, and it is used by `ansible-builder` or directly with `podman build` to create the image.

Answer

Storing the execution environment in a public registry only

Answer

Setting the execution_environment_image in the project's SCM

Answer

Using the default execution environment provided by controller

Question 12

An OpenShift rolling update is failing because new pods crash immediately. Which parameter automatically triggers a rollback if no progress is made?

Accepted Answer

progressDeadlineSeconds. The `progressDeadlineSeconds` parameter specifies the maximum duration (in seconds) that a deployment can make no progress before it is considered to have failed. When this deadline is exceeded, the deployment controller automatically triggers a rollback to the previous revision. This is the correct parameter for automatically rolling back a failed rolling update where new pods crash immediately.

Answer

revisionHistoryLimit

Answer

maxSurge

Answer

maxUnavailable

Answer

minReadySeconds

Question 13

Which TWO statements are true about deploying Red Hat Ansible Automation Platform using the automation mesh?

Accepted Answer

Execution nodes can be located in different geographic regions.. The automation mesh is designed to support distributed topologies where execution nodes can be located in different geographic regions. The mesh uses peer-to-peer connections over standard TCP ports, allowing nodes to communicate across network boundaries without requiring a centralized controller in each region.

Answer

Existing Ansible Tower nodes can be added to the mesh without modification.

Answer

Automation mesh requires two separate ports for control and data plane traffic.

Answer

All execution nodes must have direct network access to the automation controller.

Question 14

An administrator needs to update a web application that runs as a Kubernetes Deployment with 5 replicas. The application is stateless, but the update must not cause any downtime. Which TWO strategies ensure zero-downtime rolling updates?

Accepted Answer

Set strategy type to RollingUpdate with maxUnavailable=0 and maxSurge=1.. Setting `maxUnavailable=0` ensures that no pods are taken down before new ones are ready, while `maxSurge=1` allows one extra pod to be created above the desired replica count, enabling a rolling update without any downtime. This combination guarantees that at least 5 pods are always available during the update process.

Answer

Omit the liveness probe from the pod spec.

Answer

Set maxUnavailable=1 and maxSurge=0.

Answer

Use the Recreate strategy.

Question 15

A developer wants to create a new collection named 'myutils' under namespace 'myorg'. Which command initializes the collection structure?

Accepted Answer

ansible-galaxy collection init myorg.myutils. The correct command to initialize a new Ansible collection structure is `ansible-galaxy collection init <namespace.collection>`. This creates the required directory layout, including `galaxy.yml`, `README.md`, and subdirectories like `roles/`, `playbooks/`, and `plugins/`. Option D matches this syntax exactly.

Answer

ansible-galaxy collection scaffold myorg.myutils

Answer

ansible-galaxy collection create myorg.myutils

Answer

ansible-galaxy collection new myorg.myutils