EX294 Practice Test 33 — 15 Questions

Question 1

An organization uses Ansible to manage an AWS EC2 environment. The Ansible control node runs on a Linux server, and the team uses a dynamic inventory script (ec2.py) to automatically populate hosts. Recently, they need to run a playbook only against EC2 instances that have a specific tag, 'Environment', set to 'production'. The team has placed the ec2.ini configuration file in the same directory as the inventory script. However, when they run the playbook with '-i ec2.py', the playbook runs against all instances instead of only production ones. The team verifies that the tag exists on the correct instances and that the environment variable AWS_PROFILE is set correctly. Which action should resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the ec2.ini file to include 'filters = tag:Environment=production' under the [ec2] section.. The ec2.py dynamic inventory script uses ec2.ini settings to filter instances. To filter by tags, the 'regions_exclude' and 'destination_variable' are set, but the 'filters' setting inside the 'ec2' section must be configured to include 'tag:Environment=production'. Option B correctly identifies that the ec2.ini must be modified with the 'filters' option. Option A is incorrect because 'hostname' is for naming hosts, not filtering. Option C would not filter by the tag. Option D is unrelated.

Answer

Set the environment variable 'EC2_TAGS=Environment=production' before running the playbook.

Answer

Use the '--limit' option with the playbook command to specify the tag.

Answer

Add the option 'hostname = tag_Name' to the ec2.ini file.

Question 2

Which TWO actions are required to use a private Automation Hub to share collections?

Accepted Answer

Configure the server in ansible.cfg under [galaxy] server_list.. Required because you must configure the private Automation Hub server in ansible.cfg under [galaxy] server_list to tell ansible-galaxy where to find collections. Option E is required because you need an API token for authentication, stored in ansible.cfg or as an environment variable; without it, access to the private hub is denied. Option B (building a custom execution environment) is optional and not a prerequisite for sharing collections – it is used for distributing collections in EEs. Option C (--ignore-certs) is only necessary if you use self-signed certificates, not a general requirement. Option D (ansible-navigator with --pull-policy missing) relates to pulling EEs, not to sharing collections from a private hub.

Answer

Build a custom execution environment that includes the collections.

Answer

Run ansible-galaxy collection install --ignore-certs if using self-signed certs.

Answer

Use ansible-navigator with --pull-policy missing.

Question 3

A DevOps team uses Ansible to manage a large fleet of web servers. They have a custom filter plugin, `custom_encrypt`, stored in `/opt/ansible/filter_plugins/custom_encrypt.py`. This filter works correctly in Ansible 2.9. After upgrading the control node to Ansible 2.14 (ansible-core 2.14), the filter is no longer found. The `ansible.cfg` includes `filter_plugins = /opt/ansible/filter_plugins` and the file permissions are 644. The team verified the Python file is valid and contains the correct `FilterModule` class with a `filters()` method. Which of the following is the most likely cause of the issue?

Accepted Answer

The filter name used in playbooks does not match the name defined in the plugin's `filters()` method.. In ansible-core, filter plugins are loaded dynamically, and the filter name used in playbooks must exactly match one of the keys returned by the plugin's `filters()` method. If the plugin defines a filter named 'encrypt' but playbooks call it as 'custom_encrypt', it will not be found. The filename does not need to match the filter name. Option A is incorrect because `filter_plugins` can point to any directory. Option C is incorrect because the team confirmed the `filters()` method exists. Option D is incorrect because standalone filter plugins are deprecated but still functional in 2.14; deprecation alone does not cause the filter to be 'no longer found'.

Answer

The `ansible.cfg` path must be under `~/.ansible/plugins/filter_plugins`.

Answer

The filter plugin is missing a `filters()` method.

Answer

The filter plugin must be part of an Ansible collection because standalone filter plugins are deprecated.

Question 4

During a collection development, a developer wants to include a Python dependency that is not available in the base image of the execution environment. Where should this dependency be declared?

Accepted Answer

In the execution-environment.yml under 'dependencies' -> 'python'. In Ansible execution environments, Python dependencies that are not part of the base image must be declared in the `execution-environment.yml` file under the `dependencies` key, specifically within the `python` subkey. This file is used by `ansible-builder` to build a custom container image that includes those additional Python packages. The base image already contains a standard set of Python libraries, but any extra ones needed by a collection must be explicitly listed here to be installed during the build process.

Answer

In the collection's requirements.yml under 'python'

Answer

In the collection's galaxy.yml under 'dependencies'

Answer

In the collection's meta/runtime.yml under 'python_dependencies'

Question 5

An Ansible Tower administrator needs to allow a team of developers to run playbooks against specific inventory groups without allowing them to modify the inventory or credentials. Which approach best satisfies the requirement?

Accepted Answer

Assign the developers the 'Execute' role on the inventory and 'Use' role on the credential.. The 'Execute' role on an inventory allows a user to run playbooks against that inventory without granting permission to modify its contents. The 'Use' role on a credential permits the credential to be used in job templates but not viewed or edited. This combination precisely meets the requirement of allowing playbook execution while preventing inventory or credential modification.

Answer

Assign the developers the 'Update' role on the inventory and 'Admin' role on the credential.

Answer

Assign the developers the 'Admin' role on the inventory and 'Read' role on the credential.

Answer

Assign the developers the 'Read' role on both inventory and credential.

Question 6

An organization uses multiple Ansible Automation Platform clusters in different geographies. Each cluster has its own set of credentials for different environments. An administrator needs to ensure that job templates launched in the EMEA cluster can only use EMEA-specific credentials, while the APAC cluster uses APAC-specific credentials, without duplicating job template definitions. What is the best approach?

Accepted Answer

Configure separate organizations for each cluster and assign credentials to each organization, then use the same job template within each organization. Ansible Automation Platform organizations provide a logical boundary for credentials, projects, and job templates. By creating separate organizations for the EMEA and APAC clusters, the administrator can assign EMEA-specific credentials to the EMEA organization and APAC-specific credentials to the APAC organization. The same job template can then be created within each organization, inheriting only the credentials assigned to that organization, thus avoiding duplication of the job template definition while enforcing credential isolation.

Answer

Create separate job templates for each cluster and assign the appropriate credentials

Answer

Use the same job template and rely on host tags in the inventory to filter which credentials are used

Answer

Use an external secrets management system and call it via lookup plugin in the playbook

Question 7

A user wants to build an execution environment from a definition file. Which command is used?

Accepted Answer

ansible-builder build -f execution-environment.yml. The `ansible-builder build` command is the correct tool for building an Ansible execution environment from a a definition file. The `-f` flag specifies the path to the `execution-environment.yml` file, which defines the base image, required collections, and system dependencies for the containerized environment.

Answer

ansible-playbook build -i ee.yml

Answer

ansible-execution-environment build -f ee.yml

Answer

ansible-galaxy build execution-environment.yml

Question 8

A junior admin runs the command shown in the exhibit. What is the most likely cause of the error?

Accepted Answer

The playbook uses incorrect YAML syntax; the task should use the 'module' keyword.. The error shown in the exhibit is a YAML syntax error: the task uses a module name (e.g., `shell`) directly as a key, but Ansible requires the `module` keyword to specify the module when using `ansible-navigator` or `ansible-playbook` with strict YAML parsing. The correct syntax is `module: shell` or using the module name as a top-level key only in older playbook formats, which `ansible-navigator` rejects.

Answer

The 'ansible.builtin' collection is not installed in the execution environment.

Answer

The shell module requires a command argument that is missing.

Answer

The playbook file path is incorrect; ansible-navigator cannot find the file.

Question 9

Refer to the exhibit. What is the most likely cause of the job being in 'pending' state?

Accepted Answer

The job is queued because the capacity limit of the automation controller is reached.. In Ansible Automation Platform, when a job is in 'pending' state, it typically indicates that the automation controller has queued the job because the maximum number of concurrent jobs (capacity limit) has been reached. The controller uses a job fork limit and instance group capacity to determine how many jobs can run simultaneously; once that limit is hit, additional jobs are placed in a pending queue until capacity frees up.

Answer

The credential is invalid and the system is attempting to validate it.

Answer

The job template is configured with a survey that requires approval.

Answer

The project needs to be updated before the job can run.

Question 10

Which TWO factors should be considered when choosing a base container image for an execution environment?

Accepted Answer

The presence of ansible-core and ansible-runner.. An execution environment is a container image that includes all dependencies needed to run Ansible automation. For it to function correctly, the base image must contain `ansible-core` and `ansible-runner`, as these provide the core automation engine and the runner that manages playbook execution, respectively. Without these components, the container cannot execute Ansible jobs, making their presence a mandatory requirement.

Answer

The date of the last update.

Answer

The size of the image.

Answer

The number of layers.

Question 11

Which THREE statements correctly describe the behavior of the 'serial' keyword in Ansible? (Choose exactly three.)

Accepted Answer

It can be set as a percentage of the total hosts.. The 'serial' keyword in Ansible can be specified as a percentage (e.g., 'serial: 50%'), which tells Ansible to run the play on that percentage of hosts in the batch at a time. This is useful for controlling the rollout pace across a dynamic inventory where the exact host count may vary.

Answer

It guarantees that only one task runs across all hosts at any time.

Answer

It applies globally to all plays in the playbook.

Question 12

An admin wants to use custom Python modules in a job template without affecting the global controller environment. What should be used?

Accepted Answer

Create a custom virtual environment and assign it to the job template.. Custom Python modules must be isolated from the global controller environment to avoid conflicts. Ansible Tower/AWX allows you to create a custom virtual environment and assign it to a job template, ensuring that only the modules installed in that environment are used during job execution, leaving the global controller unaffected.

Answer

Install the modules globally on the controller.

Answer

Execution environment with custom collections.

Answer

Use a custom credential type that includes Python modules.

Question 13

What is the effect of setting 'serial: 5' in an Ansible playbook that targets a group of 20 hosts?

Accepted Answer

The playbook runs on 5 hosts at a time, sequentially.. Setting 'serial: 5' in an Ansible playbook configures the playbook to execute each task on a batch of 5 hosts at a time, moving to the next batch only after the current batch completes all tasks. This ensures that no more than 5 hosts are processed concurrently, providing controlled, sequential rolling updates across the 20-host group.

Answer

The playbook runs on 5 hosts per task, then moves to next task.

Answer

The playbook runs only on the first 5 hosts.

Answer

The playbook runs on all 20 hosts at once.

Question 14

An Ansible playbook uses a 'block' to group multiple tasks and includes a 'rescue' section. If a task inside the block fails, what will happen?

Accepted Answer

the rescue section runs, and the playbook continues with tasks after the block. In Ansible, a 'block' groups tasks, and a 'rescue' section defines tasks to run if any task in the block fails. When a task inside the block fails, the rescue section executes, and then the playbook continues with the next task after the block. Option C correctly describes this behavior. Option A is incorrect because the rescue does run, but the playbook continues after the block, not just with the next task. Option B is incorrect because the block is not re-executed. Option D is incorrect because the playbook does not stop; it continues after the rescue.

Answer

the rescue section runs and then the playbook resumes with the next task after the block

Answer

the block is re-executed from the beginning

Answer

the playbook stops immediately

Question 15

Your organization is migrating from manually maintained control nodes to using execution environments. You have created an execution environment that includes all necessary collections and Python dependencies. You want to ensure that developers use this execution environment when running playbooks. You have configured ansible-navigator on their workstations. However, some developers report that when they run a playbook, it uses the local installation of Ansible instead of the execution environment. What should you check first?

Accepted Answer

Ensure that the developers are using the 'ansible-navigator run' command instead of 'ansible-playbook'.. `ansible-navigator` is the CLI tool designed to run Ansible inside an execution environment. If developers run `ansible-playbook` directly, it uses the locally installed Ansible, bypassing the execution environment entirely. The question states that `ansible-navigator` is configured on their workstations, but the developers must use the `ansible-navigator run` subcommand to invoke playbooks within the containerized environment.

Answer

Confirm that the developers have installed ansible-builder locally.

Answer

Verify that the ansible-navigator configuration file points to the correct execution environment image.

Answer

Check that the execution environment container is running on the developers' machines.