EX294 Practice Test 35 — 15 Questions

Question 1

A playbook uses the 'win_chocolatey' module to install software on Windows hosts. The playbook is idempotent for most packages, but one package consistently fails with 'The package is already installed' error despite being reinstalled each run. Which approach ensures true idempotency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a win_shell task with a check command to detect installation, and conditionally run the win_chocolatey task only when absent.. The win_chocolatey module's 'state=present' does not guarantee idempotency for all packages; some packages may not report their installed state correctly to Chocolatey, causing the module to attempt installation every run and fail with 'already installed'. By using a win_shell task with a check command (e.g., `choco list --local-only`) to detect installation and conditionally running the win_chocolatey task only when absent, you bypass the module's flawed state detection and achieve true idempotency.

Answer

Change state=present to state=latest to ensure the module only updates if needed.

Answer

Use the 'force' option in win_chocolatey to allow reinstalling, and ignore the error.

Answer

Add a 'when' condition to skip the package if it is already installed based on a registered variable from the win_chocolatey module's results.

Question 2

An admin is creating a workflow that must run a survey at the beginning to collect user input. Which node type should be used for the first step?

Accepted Answer

Job Template node with survey enabled. A Job Template node with survey enabled is the correct choice because surveys in Ansible Automation Platform allow you to prompt the user for variables at runtime before the job runs. This is the only node type that can collect user input as the first step in a workflow, as it presents a form to the user and passes the entered values as extra variables to the job.

Answer

Workflow node

Answer

Approval node

Answer

Project Sync or Inventory Sync node

Question 3

A collection version is already published on Automation Hub. The developer needs to update the collection with a new feature. What must be done to the version number before publishing again?

Accepted Answer

Increment the patch or minor version number.. Automation Hub enforces immutable collection versions; once a version is published, it cannot be overwritten or deleted. To publish a new feature, you must increment the patch (e.g., 1.0.0 → 1.0.1) or minor (e.g., 1.0.0 → 1.1.0) version number in the galaxy.yml file, following semantic versioning (semver) as required by Ansible collections.

Answer

No change needed; Automation Hub overwrites.

Answer

Increment the major version number.

Answer

Change the version to a pre-release identifier.

Question 4

A user runs the commands shown in the exhibit. The execution environment (EE) builds successfully but the playbook run fails with the error. What is the most likely cause?

Accepted Answer

The collection 'community.general' was not included in the execution environment definition file.. The error indicates that the playbook requires the 'community.general' collection, which is not available in the execution environment. Since the EE builds successfully but the playbook fails, the most likely cause is that the collection was omitted from the execution environment definition file (e.g., execution-environment.yml or requirements.yml). Without it, the collection is not installed in the EE, causing the playbook to fail at runtime.

Answer

The collections_path in ansible.cfg points to a non-existent directory.

Answer

The execution environment image tag is incorrect.

Answer

The --pp never flag prevents the EE from being pulled.

Question 5

The playbook uses the community.general.parse_csv filter. Assuming the collection is installed, what is the type and structure of the 'parsed' variable?

Accepted Answer

A list of dictionaries: [{'name': 'Alice', 'age': '30'}, {'name': 'Bob', 'age': '25'}]. The `community.general.parse_csv` filter in Ansible parses CSV content into a list of dictionaries, where the first row is treated as headers and subsequent rows become dictionaries with those headers as keys. Option A correctly describes this output: a list of dictionaries with keys 'name' and 'age' and corresponding string values.

Answer

A single string: 'Alice,30
Bob,25'

Answer

A list of strings: ['name,age', 'Alice,30', 'Bob,25']

Answer

A dictionary: {'Alice': '30', 'Bob': '25'}

Question 6

An Ansible playbook contains many tasks. An administrator wants to run only a subset of tasks by passing '--tags ' at the command line. Which of the following must be added to the tasks?

Accepted Answer

a 'tags' directive on each task. The 'tags' directive is the only mechanism in Ansible that allows tasks to be selectively included or excluded when running a playbook with the '--tags' command-line option. By adding a 'tags' attribute to a task (e.g., 'tags: install'), the administrator can target that task specifically, and Ansible's task execution engine filters tasks based on the provided tags at runtime.

Answer

a 'name' with specific naming convention

Answer

a 'block' statement

Answer

a 'when' condition

Question 7

Which THREE factors are essential for achieving idempotent behavior in Ansible plays?

Accepted Answer

Task execution order should not affect the final state.. Options A, B, and E are correct for achieving idempotent behavior in Ansible plays. A is correct because idempotent tasks should produce the same final state regardless of the order they are executed; this ensures consistency across multiple runs. B is correct because idempotent modules check the current state before making any changes, only acting when the desired state differs, which is fundamental to idempotency. E is correct because 'ignore_errors' should be used sparingly; overusing it can mask failures that would otherwise leave the system in a non-idempotent state, as subsequent runs may not correct hidden issues. C is incorrect because registered variables can be used in an idempotent manner; they do not inherently break idempotency. D is incorrect because loops can be idempotent if the module inside the loop is idempotent and the loop is designed to handle conditional changes.

Answer

Variables registered from previous tasks should be avoided.

Answer

Loops must be avoided because they always cause changes.

Question 8

A managed node is configured with an Ansible vault-encrypted variable file. When running a playbook that uses these variables, the user receives a 'decryption failed' error. Which two steps should the user take to resolve the issue?

Accepted Answer

Ensure the vault ID matches the one used when encrypting the file.. Ansible vault supports multiple vault IDs (labels) to manage different passwords for different encrypted files. If the vault ID used during decryption does not match the one used when encrypting the file, Ansible will fail to decrypt it, even if the correct password is provided. The `--vault-id` option or `ANSIBLE_VAULT_ID_MATCH` environment variable must align the ID with the encryption context.

Answer

Verify the file permissions are set to 600.

Answer

Check that the SSH private key has access to the managed node.

Answer

Make sure the vault password file contains the path to the vault file.

Question 9

A team wants to ensure that a sensitive variable, such as a database password, is not printed when ansible-playbook runs with -v (verbose). What is the best method to achieve this?

Accepted Answer

Use the 'no_log: true' directive on the task.. The `no_log: true` directive explicitly prevents Ansible from printing the value of any variable used in that task to the console, even when verbosity is increased with `-v`. This is the most direct and secure method to ensure sensitive data like passwords are not exposed in output logs, as it overrides the default logging behavior at the task level.

Answer

Set the password as an environment variable on the control node.

Answer

Store the password in a file with 0600 permissions and use lookup('file', ...).

Answer

Use the 'ansible-vault encrypt_string' command and reference the variable from a vault file.

Question 10

A developer wants to encrypt a string in a playbook variable file. Which command should they use?

Accepted Answer

ansible-vault encrypt_string. `ansible-vault encrypt_string` is specifically designed to encrypt a single string value for use in a playbook variable file, without encrypting the entire file. This command outputs the encrypted string in a format that can be directly pasted into a YAML variable definition, preserving the rest of the file as plaintext.

Answer

ansible-vault rekey

Answer

ansible-vault create

Answer

ansible-vault edit

Question 11

A job template has failed. Which TWO logs should be examined first to diagnose the issue?

Accepted Answer

/var/log/tower/tower.log. `/var/log/tower/tower.log` is the primary log file for the Ansible Tower/Automation Controller service itself, capturing all controller-level events, errors, and system messages. When a job template fails, this log is the first place to check for underlying service issues, authentication failures, or configuration problems that prevented the job from starting or completing. Option B is correct because `/var/log/tower/job_callback.log` specifically records callback data from job runs, including the final status and any errors returned by the Ansible playbook execution, making it essential for diagnosing job-specific failures.

Answer

Automation controller job stdout

Answer

/var/log/messages

Answer

/var/log/nginx/access.log

Question 12

You are responsible for maintaining a team of 10 Ansible developers. They all rely on a shared collection stored in a private Git repository. Recently, multiple developers reported that their playbooks are failing because they have different versions of the collection installed locally. You decide to standardize the environment by creating a consistent Ansible execution environment. You have a base image of Red Hat Enterprise Linux 8.6, and you need to include the collection from the Git repository. Additionally, the execution environment should be rebuilt automatically whenever the collection is updated. Which approach should you take?

Accepted Answer

Write an execution-environment.yml that specifies the base image and uses the 'git' option under 'dependencies' to pull the latest collection from the Git repo, then configure a webhook to rebuild the image on each push.. It uses an execution-environment.yml file with the 'git' option under 'dependencies' to pull the collection directly from the private Git repository during the image build process. This ensures that every build includes the latest version of the collection, and by configuring a webhook (e.g., from GitLab or GitHub) to trigger a rebuild on each push, the environment is automatically standardized across all developers. This approach directly addresses the version inconsistency problem by creating a consistent, version-controlled execution environment.

Answer

Use ansible-navigator to run the playbooks directly from the Git repository without building an execution environment.

Answer

Create a requirements.yml file for the developers to install the collection manually on their local machines.

Answer

Build the execution environment once using ansible-builder and distribute the resulting container image to all developers manually.

Question 13

An administrator sees this output during a playbook run. What can they conclude?

Accepted Answer

The task had ignore_errors set to yes. When a task fails in Ansible but the playbook continues execution and shows a 'changed' or 'ok' status instead of 'failed', it indicates that the task has `ignore_errors: yes` set. This directive tells Ansible to treat any failure as a success, allowing the play to proceed without interruption.

Answer

The playbook was run with the --ignore-errors command-line flag

Answer

The task was part of a block with rescue

Answer

The playbook was run with the --check flag

Question 14

Refer to the exhibit. An Ansible playbook contains the following block structure. If the task inside the block fails, which of the following describes the execution order of the rescue and always sections?

Accepted Answer

Rescue runs, then always.. In Ansible, when a task inside a block fails, the rescue section executes to handle the failure, and then the always section runs unconditionally. This ensures that cleanup or finalization tasks are performed regardless of success or failure. Therefore, the correct execution order is rescue first, then always.

Answer

Only always runs.

Answer

Only rescue runs.

Answer

Always runs, then rescue.

Question 15

Refer to the exhibit. An Ansible user runs `ansible-navigator` from the `/home/user/project` directory. The execution environment image is not present locally. What will occur?

Accepted Answer

The image will be pulled from the registry because the pull policy is 'missing'.. The default pull policy for `ansible-navigator` when using an execution environment is `missing`. This means that if the specified image is not present locally, the container engine (podman or docker) will automatically pull it from the configured registry. Since the image is not present locally, the pull will occur without requiring any additional flags.

Answer

The container engine will default to docker because podman is not a valid engine.

Answer

The volume mount will fail because the source path is not absolute.

Answer

The image will be pulled only if the --pull flag is passed on the CLI.