EX294 Practice Test 36 — 15 Questions

Question 1

Your team is responsible for managing a fleet of 200 RHEL 8 servers using Ansible Tower. You have been asked to implement a secure automation workflow that meets the following requirements:

1. All playbooks must be stored in a private Git repository hosted on an internal GitLab server.
2. Credentials to access the Git repository must be stored securely in Ansible Tower.
3. The automation must run on a schedule every night at 2:00 AM.
4. If a playbook run fails, the team must be notified via email.
5. The playbooks require SSH private keys to connect to the managed hosts; these keys must be stored securely.
6. A development team needs to be able to launch the same job template manually, but they must not be able to modify the job template or view the credentials.

You have created a Machine Credential for SSH and a Source Control Credential for Git. You have also created a Job Template that references the project, inventory, and credentials. What is the correct sequence of steps to satisfy all requirements?

Accepted Answer

1. Create a Project in Tower, pointing to the Git repository and associate the Source Control Credential. 2. Create a Job Template referencing the Project, and add the Machine Credential. 3. Assign the development team read and execute permissions on the Job Template (not admin). 4. Create a Schedule for the Job Template to run at 2:00 AM. 5. Configure a Notification Template for email on failure and associate it with the Job Template.. It correctly sequences the steps: first creating a Project with the Source Control Credential to securely access the private Git repository, then creating a Job Template that references the Project and includes the Machine Credential for SSH access to managed hosts. Assigning the development team 'read and execute' permissions (not admin) satisfies the requirement that they can launch the job template manually but cannot modify it or view credentials. Creating a Schedule for 2:00 AM and configuring a Notification Template for email on failure completes the automation workflow.

Answer

1. Create a Project in Tower, pointing to the Git repository and associate the Source Control Credential. 2. Create a Job Template referencing the Project. 3. Add the Machine Credential to the Job Template. 4. Create a Schedule for the Job Template. 5. Assign the development team execute-only permissions on the Job Template. 6. Configure a Notification Template for email on failure.

Answer

1. Create a Schedule for 2:00 AM. 2. Create a Project in Tower with Source Control Credential. 3. Create a Job Template with Machine Credential. 4. Assign the development team admin permissions on the Job Template. 5. Configure a Notification Template.

Answer

1. Create a Project in Tower, pointing to the Git repository without a credential. 2. Create a Job Template referencing the Project. 3. Add the Source Control Credential to the Job Template. 4. Create a Schedule for the Job Template. 5. Assign the development team read-only permissions on the Job Template. 6. Configure a Notification Template for email on failure.

Question 2

A large enterprise runs a multi-tenant Ansible Automation Platform deployment. The security team has mandated strict role-based access control (RBAC) for three departments: Network (manages routers/switches), Security (manages firewalls/IDS), and Operations (manages servers/applications). Each department must have its own projects, inventories, job templates, and credentials. Additionally, credentials must not be viewable by users who do not own them. The platform currently uses a single organization with one team and all users have admin permissions. Which course of action best meets these requirements?

Accepted Answer

Create three organizations (Network, Security, Operations). Within each organization, create a team, assign users, and grant appropriate permissions. Use custom roles to restrict credential access to team members only.. Creating separate organizations for each department provides the strongest isolation boundary in Ansible Automation Platform. Within each organization, a dedicated team with custom roles ensures that credentials are scoped to that team and cannot be viewed by users outside it, satisfying the RBAC and credential visibility requirements.

Answer

Create custom roles with no organizations. Assign users directly to resources via user-level permissions.

Answer

Keep a single organization but create three teams. Assign each team to its own projects and inventories, and use job template-level permissions to restrict access.

Answer

Use a single organization with one team. Set all credentials to 'read-only' to prevent viewing of secret values.

Question 3

An administrator wants to use an Ansible role from Ansible Galaxy but the role has a dependency on another role that is already installed. What should be done to avoid conflicts?

Accepted Answer

Set 'allow_duplicates: false' in the parent role's meta/main.yml.. (set allow_duplicates: false) is correct to prevent the dependency from running twice. Option B (force install) overwrites but doesn't prevent duplicate execution. Option C (collection) is a different concept. Option D (no action) would cause the role to run twice by default.

Answer

Define the dependency as a collection.

Answer

Use 'galaxy install --force' to overwrite.

Answer

No action needed; Ansible handles duplicates automatically.

Question 4

Drag and drop the steps to configure a logical volume (LV) using LVM on a new disk in the correct order.

Accepted Answer

Create physical volume, then create volume group, then create logical volume, then format with filesystem, then mount the filesystem.. The correct sequence for configuring a logical volume using LVM on a new disk is: first create a physical volume from the disk, then create a volume group from that physical volume, then create a logical volume from the volume group, then format the logical volume with a filesystem, and finally mount the filesystem to make it accessible. This order ensures that each step builds upon the previous one, following the LVM hierarchy of PV -> VG -> LV -> filesystem -> mount.

Answer

Create physical volume, then create logical volume, then create volume group, then format with filesystem, then mount the filesystem.

Answer

Create volume group, then create physical volume, then create logical volume, then format with filesystem, then mount the filesystem.

Answer

Create physical volume, then create volume group, then format with filesystem, then create logical volume, then mount the filesystem.

Question 5

An organization uses a proprietary API service that requires token-based authentication with a base64-encoded payload including username, password, and tenant ID. The administrator wants to create a custom credential type in automation controller so that users can input these three values separately, and the playbook receives the final token. Which input configuration fields should be defined?

Accepted Answer

Three separate text fields (username, password, tenant ID) with a custom injector template that concatenates and base64-encodes them.. Automation controller custom credential types allow defining multiple input fields (username, password, tenant ID) and a custom injector template that can concatenate and base64-encode these values into a single token. The injector template uses Jinja2 syntax to combine the inputs and apply the `b64encode` filter, so the playbook receives the final base64-encoded token as a single credential variable.

Answer

One text field for the token, and inject it as an environment variable.

Answer

Two fields: username and password, and use a lookup plugin to fetch tenant ID.

Answer

Create a single multiline text field where users paste the base64 string.

Question 6

An organization uses an external secrets management system (e.g., HashiCorp Vault) to store sensitive credentials. They want to integrate it with Ansible Automation Platform so that job templates automatically retrieve credentials from Vault without storing them in the AAP database. Which approach is supported?

Accepted Answer

Create a custom credential type with an injector that uses a lookup plugin to fetch the secret from Vault. Ansible Automation Platform supports custom credential types that can use lookup plugins (such as `hashi_vault`) to retrieve secrets from external systems like HashiCorp Vault at runtime. The injector template can define environment variables or extra variables that are populated by the lookup plugin, ensuring credentials are never stored in the AAP database.

Answer

Use the built-in 'Machine' credential type and store the Vault token in the credential

Answer

Store the secret in an extra variable and reference it in the playbook

Answer

Use the 'Ansible Vault' credential type to decrypt vault-encrypted variables in the project

Question 7

Refer to the exhibit. The playbook uses the 'yum' module to install 'httpd' on a RHEL 8 system. Which of the following is the most likely cause of the failure?

Accepted Answer

The AppStream repository is not enabled on the target host.. On RHEL 8, the `yum` command is a symbolic link to `dnf`, and the `yum` Ansible module internally uses `dnf` as the backend. The most common cause of failure when installing a package like `httpd` on RHEL 8 is that the AppStream repository (which contains `httpd`) is not enabled or available on the target host. Without an enabled repository containing the package, the module cannot resolve and install it, leading to a failure.

Answer

The 'yum' module is deprecated for RHEL 8; must use 'dnf'.

Answer

The remote host does not have subscription-manager access.

Answer

The package name is misspelled; it should be 'apache2'.

Question 8

A company uses Ansible to manage rolling updates of a web server fleet. During a deployment, the playbook fails on one host due to a transient network error, and the rest of the fleet is left in an inconsistent state. Which strategy would best minimize the risk of inconsistency in future rolling updates?

Accepted Answer

Set max_fail_percentage to 0 in the serial block to abort the rollout on any failure.. Setting `max_fail_percentage: 0` in a rolling update (using `serial`) tells Ansible to abort the entire playbook run if any single host fails. This prevents the rest of the fleet from being updated, avoiding an inconsistent state where some hosts have the new deployment and others do not. It directly addresses the risk of partial rollouts caused by transient errors.

Answer

Add retries to each task so transient errors are automatically retried.

Answer

Use a larger serial batch size to complete the rollout faster.

Answer

Set ignore_errors: yes on all tasks to continue despite failures.

Question 9

An automation team wants to grant a group of operators the ability to launch job templates in automation controller but prevent them from modifying the job template configuration. They also need to troubleshoot failed jobs by viewing job output. Which predefined role should be assigned to the team for a specific job template?

Accepted Answer

Execute role. The Execute role is the correct predefined role because it grants permission to launch a job template and view job output (including standard out and error logs) without allowing any modifications to the job template's configuration. This aligns exactly with the requirement: operators can execute and troubleshoot failed jobs but cannot edit the template.

Answer

Read role

Answer

Admin role

Answer

Update role

Question 10

An administrator needs to store a database password securely for use in playbooks. Which credential type should they create?

Accepted Answer

Vault credential. A Vault credential is the correct choice because Ansible Vault is specifically designed to encrypt sensitive data like passwords, API keys, and other secrets used in playbooks. It allows the administrator to store the database password in an encrypted file that can be decrypted at runtime using a vault password, ensuring the secret is not exposed in plaintext in the playbook or inventory.

Answer

Source control credential

Answer

Machine credential

Answer

Network credential

Question 11

A team is setting up an Ansible execution environment that requires a specific version of a Python library that is not available in the default base image. The team wants to minimize the size of the final container. Which approach should they take in the execution-environment.yml file?

Accepted Answer

Use the 'dependencies' key with 'python' to specify the library and version.. The `dependencies` key in `execution-environment.yml` allows specifying Python libraries and their versions under the `python` subkey. Ansible Builder will then install these dependencies during the build process, ensuring the required library is available without bloating the final container with unnecessary layers or manual RUN commands.

Answer

Use the 'additional_build_steps' key to add a RUN command that installs the library via pip.

Answer

Use the 'base_image' key to point to a custom image that already contains the library.

Answer

Use the 'galaxy' key to install the library from a collection.

Question 12

Which THREE are valid credential types in Ansible Tower?

Accepted Answer

Network credential. All five options—Network, Machine, Source control, Cloud, and Vault—are valid credential types in Ansible Tower. The question asks for three, but since all are valid, any combination of three would be correct. However, to match the expected answer set, all options are considered correct.

Question 13

Which TWO of the following are valid methods to include external variable files into an Ansible playbook?

Accepted Answer

using the 'include_vars' module. The 'include_vars' module dynamically loads variables from external files into a playbook at runtime, allowing for conditional or loop-based variable inclusion. Option E is correct because the 'vars_files' directive statically specifies external variable files to be parsed before task execution, a standard method for separating variable data from play logic.

Answer

using the 'add_host' module

Answer

using the 'set_fact' module

Answer

using '-e' command line option

Question 14

An organization is deploying Automation Platform for the first time. The security team requires that all SSH private keys used for automation be stored securely with access controls. Which AAP feature should be used to meet this requirement?

Accepted Answer

Create a Machine credential type and upload the SSH private key.. The Machine credential type in Ansible Automation Platform (AAP) is specifically designed to securely store SSH private keys. When you upload the private key via the AAP web UI or API, it is encrypted at rest in the AAP database and access is controlled through role-based access control (RBAC). This meets the security team's requirement for secure storage and access controls without exposing the key in plain text.

Answer

Store the private key in plain text within the inventory file.

Answer

Use Ansible Vault to encrypt the private key file.

Answer

Set the SSH key as an environment variable on the controller.

Question 15

Refer to the exhibit. A developer builds an execution environment using this execution-environment.yml. After building, the container starts but ansible-navigator cannot connect to the container because the required SSH packages are missing. Which file most likely needs to be updated?

Accepted Answer

bindep.txt. D is correct because `bindep.txt` specifies system-level package dependencies (like `openssh-clients` or `sshpass`) that must be installed in the container image. When building an execution environment, `ansible-builder` reads `bindep.txt` to install RPM packages via `dnf` (or `apt` on Debian-based images). If SSH packages are missing, the `bindep.txt` file is the most likely place to add them, as it directly controls which system packages are included in the final image.

Answer

The base image itself

Answer

requirements.yml

Answer

requirements.txt