EX294 Practice Test 37 — 15 Questions

Question 1

Which TWO statements about execution environments are true?

Accepted Answer

Execution environments can include both Ansible and system dependencies.. Execution environments bundle both Ansible-specific dependencies (e.g., ansible-core, collections) and system-level dependencies (e.g., Python libraries, SSH clients), making statement A correct. Statement E is correct because execution environments are container images that conform to the Open Container Initiative (OCI) standard. Statement B is incorrect because execution environments can be used directly with ansible-playbook by setting the ANSIBLE_EXECUTION_ENVIRONMENT environment variable or using the --execution-environment flag; they are not limited to ansible-navigator. Statement C is incorrect because while ansible-builder is a common tool, other methods like Dockerfiles or pre-built images from registries are also valid. Statement D is incorrect because ansible-navigator is not mandatory; ansible-playbook or ansible-runner can also use execution environments.

Answer

Execution environments cannot be used with ansible-playbook directly.

Answer

Execution environments must be built using ansible-builder.

Answer

Ansible Navigator is required to use execution environments.

Question 2

Drag and drop the steps to configure an Ansible control node for managing remote hosts into the correct order.

Accepted Answer

1. Install Ansible on the control node. 2. Define an inventory file with remote hosts. 3. Set up SSH key-based authentication. 4. Verify connectivity using `ansible all -m ping`.. Ansible requires installation, inventory definition, SSH key-based authentication, and connectivity verification before managing hosts.

Answer

1. Install Ansible on the control node. 2. Set up SSH key-based authentication. 3. Define an inventory file with remote hosts. 4. Verify connectivity using `ansible all -m ping`.

Answer

1. Define an inventory file with remote hosts. 2. Install Ansible on the control node. 3. Set up SSH key-based authentication. 4. Verify connectivity using `ansible all -m ping`.

Answer

1. Install Ansible on the control node. 2. Define an inventory file with remote hosts. 3. Verify connectivity using `ansible all -m ping`. 4. Set up SSH key-based authentication.

Question 3

A systems administrator needs to run a playbook that installs packages on a group of managed nodes. The playbook should run only on nodes that are part of the 'web_servers' group in the inventory. Which approach is best practice?

Accepted Answer

Set 'hosts: web_servers' in the play.. Setting 'hosts: web_servers' in the play directly targets only the nodes in that inventory group, which is the simplest and most maintainable approach. This follows Ansible's best practice of declaring the target group explicitly in the playbook rather than relying on runtime flags or conditional logic, ensuring the playbook's intent is clear and portable.

Answer

Set 'hosts: all' and use '--limit web_servers' when running ansible-playbook.

Answer

Set 'hosts: localhost' and delegate tasks to web_servers.

Answer

Set 'hosts: all' and use a 'when' condition to check if the node is in the web_servers group.

Question 4

An organization uses automation controller with multiple projects and teams. They want to enforce that only the operations team can run job templates that make changes in production, while the development team can only run job templates that deploy to development environments. Which three components should be configured to achieve this? (Choose three.)

Accepted Answer

Assign different credentials to each job template.. Credentials in automation controller (formerly Ansible Tower/AWX) define the authentication context for a job template. By assigning different credentials (e.g., SSH keys or cloud API tokens) to production and development job templates, you can enforce that only the operations team's credentials have access to production infrastructure, while the development team's credentials are restricted to development environments. This is a fundamental access control mechanism that ties authentication directly to job execution.

Answer

Set execution environments to be team-specific.

Answer

Use a workflow template that routes based on user role.

Question 5

Which TWO are valid methods to back up an Ansible Automation Controller installation? (Choose two.)

Accepted Answer

Perform a `pg_dump` of the PostgreSQL database and copy `/var/lib/awx` files.. Backing up an Ansible Automation Controller installation requires preserving both the PostgreSQL database and the file system. The `pg_dump` command creates a logical backup of the database, while copying `/var/lib/awx` captures critical configuration files, job artifacts, and credentials stored on disk. This combination ensures a complete restore capability.

Answer

Use the controller UI to export configuration via `dumpconfig`.

Answer

Execute `awx-manage backup` on the controller node.

Answer

Use `invoke-rc.d automation-controller backup`

Question 6

A company uses dynamic inventory from a cloud provider. The playbook needs to run tasks only on instances with a specific tag. The ansible_ec2_tags variable is not available. What is the most efficient method to filter hosts?

Accepted Answer

Use the amazon.aws.aws_ec2 inventory plugin with compose and keyed_groups.. The `amazon.aws.aws_ec2` inventory plugin can dynamically filter EC2 instances by tag using `keyed_groups` and `compose` at inventory build time, avoiding runtime overhead. This is the most efficient method as it pre-filters hosts before the playbook runs, unlike runtime fact gathering or lookups.

Answer

Use the hostvars lookup to check tags.

Answer

Use the ec2_instance_facts module inside the playbook to gather facts and filter.

Answer

Use a static inventory file with hosts pre-filtered.

Question 7

Which THREE considerations are important when using dynamic inventories in Ansible Tower?

Accepted Answer

Dynamic inventory groups can be nested under static groups.. Ansible Tower allows dynamic inventory groups to be nested under static groups, enabling a hybrid inventory structure where cloud-sourced hosts can be organized within manually defined static groups for more flexible automation targeting. This is supported by the Tower inventory model, which merges static and dynamic sources into a unified group hierarchy.

Answer

Each inventory source can be assigned to multiple inventories.

Answer

Custom inventory scripts must be placed in the Tower home directory.

Question 8

Which key in the galaxy.yml file defines the collection's namespace?

Accepted Answer

namespace. The `namespace` key in the `galaxy.yml` file explicitly defines the collection's namespace, which is the first part of the fully qualified collection name (FQCN) and is used to organize collections under a specific publisher or organization on Ansible Galaxy. This is a required field in the `galaxy.yml` metadata file, as per the Ansible Collection structure.

Answer

collection

Answer

authors

Answer

name

Question 9

A playbook using the 'uri' module is timing out when connecting to an external API. The network team confirms connectivity. What Ansible configuration parameter can be adjusted to increase the timeout?

Accepted Answer

ansible_timeout. `ansible_timeout` is an Ansible configuration parameter that controls the default socket-level timeout for network connections, including those made by the `uri` module. When an external API is slow to respond, increasing this value (default 10 seconds) allows the playbook to wait longer before aborting the connection attempt.

Answer

validate_certs

Answer

retries

Answer

delay

Question 10

An execution environment fails to build because `pip install` fails when installing a Python package from a private repository that requires authentication. The build works when run locally by the developer. Which approach should be taken to securely provide credentials during the `ansible-builder build` process?

Accepted Answer

Create a `pip.conf` file that uses environment variables or BuildKit secrets to inject credentials.. `ansible-builder` supports BuildKit secrets and environment variable injection via a `pip.conf` file, allowing credentials to be passed securely at build time without hardcoding them into the execution environment definition. This approach ensures that sensitive authentication tokens are not exposed in the `execution-environment.yml` or the generated `Containerfile`, and it mirrors the local developer workflow where environment variables or secret mounts are used.

Answer

Store the credentials in the Automation Hub token and reference it.

Answer

Add the credentials directly to the `Containerfile` that `ansible-builder` generates.

Answer

Include the credentials in the `execution-environment.yml` under `dependencies: python:`.

Question 11

Which TWO filters are commonly used for list manipulation in Ansible? (Select exactly two.)

Accepted Answer

`map`. The `map` filter is specifically designed for list manipulation in Ansible, allowing you to apply a transformation (such as extracting a specific attribute) to every element in a list. Option D is correct because the `select` filter is used to filter list items based on a condition, returning only those elements that match. Both are core Jinja2 filters commonly used in Ansible playbooks for processing lists.

Answer

`default`

Answer

`ternary`

Answer

`regex_replace`

Question 12

You are managing a fleet of 50 RHEL 8 servers that host a critical web application. Your Ansible control node runs RHEL 8 with Ansible 2.9. The application requires a specific package 'app-pkg' that is only available from a private YUM repository. The repository is configured on each server via a role 'repo_config'. Recently, after a security update, the repository GPG key was changed. Now, when you run the playbook to install 'app-pkg' on all servers, it fails on some servers with the error: "GPG check FAILED: key ID mismatch". On other servers, the installation succeeds. All servers have the same OS version and are configured identically via the same role. The playbook uses the 'yum' module with 'state: present'. You verify that the GPG key file on the control node is the correct new key and that the role copies it to the servers. What is the most likely cause and the best course of action?

Accepted Answer

Add a task before installing the package to clean the yum cache using the 'command' module: 'yum clean all'. This ensures the new GPG key is used.. The 'GPG check FAILED: key ID mismatch' error indicates that the yum cache on some servers still holds the old GPG key metadata. Running 'yum clean all' before installing the package forces yum to refresh its metadata and re-import the new GPG key from the repository, resolving the mismatch. Since the role copies the new key file, the issue is not the key file itself but stale cached metadata.

Answer

The repository URL might be incorrect on some servers. Use the 'uri' module to test connectivity to the repository.

Answer

The role is not copying the new GPG key to all servers. Re-run the role with 'force: yes' to ensure the key is overwritten.

Answer

Add 'disable_gpg_check: yes' to the task to bypass the GPG check temporarily.

Question 13

Ansible Builder fails during the build of an execution environment with error: 'No matching manifest for linux/amd64 in the manifest list entries'. What is the most likely cause?

Accepted Answer

The base image specified is incompatible with the host architecture.. The error 'No matching manifest for linux/amd64 in the manifest list entries' indicates that the base image specified in the execution environment definition file does not have a container image manifest for the host's CPU architecture (linux/amd64). Ansible Builder pulls the base image from a registry, and if that image only supports other architectures (e.g., linux/arm64), the build fails. This is a common issue when using a base image built for a different platform.

Answer

The ansible-builder version is too old.

Answer

The definition file has invalid syntax.

Answer

The container registry requires authentication.

Question 14

You are managing a web application deployment using Ansible. The application requires a specific version of a library (libapp) to be installed on all web servers. Your current playbook uses the role 'web' which includes a task to install libapp version 1.2. However, after a recent update, the role's defaults now specify libapp version 2.0, but you must keep version 1.2 for compatibility. You have defined a variable 'lib_version' in the playbook's vars section with value '1.2'. The role's task uses the variable 'libapp_version' (not 'lib_version'). The play fails because 'libapp_version' is undefined. What is the best way to resolve this issue without modifying the role?

Accepted Answer

Use the playbook to set libapp_version as a variable for the role: either in the play vars section or by passing it as a role parameter.. It allows you to set the variable `libapp_version` that the role expects without modifying the role itself. By defining `libapp_version` in the playbook's vars section or passing it as a role parameter, you override the role's default value (2.0) with the required version 1.2, ensuring the task uses the correct library version while preserving role integrity.

Answer

Modify the role's defaults/main.yml to set libapp_version to 1.2.

Answer

Rename your playbook variable from lib_version to libapp_version in the play vars.

Answer

Create a file roles/web/vars/main.yml with libapp_version: 1.2.

Question 15

An Ansible automation controller job template uses a custom credential type that requires a secret token. The token is stored as an extra variable in the job template definition. A security audit reveals the token is visible in plaintext in the job output. Which action should the administrator take to secure the secret?

Accepted Answer

Define the variable in the job template's 'extra variables' field with 'no_log: true' set in the playbook for that variable.. Setting `no_log: true` on the variable in the playbook prevents Ansible from printing the value of that variable in any output, including job logs. This is the standard method to hide sensitive data like tokens when they are passed as extra variables, as it works at the task level to suppress logging of the variable's content.

Answer

Vault-encrypt the variable in the playbook and reference it with {{ vault_var }}.

Answer

Create a custom credential type that injects the token as an environment variable, and remove the extra variable from the job template.

Answer

Store the token in a file on the controller with 600 permissions and use 'lookup' in the playbook.