EX294 Practice Test 37 — 15 Questions

Question 1

A senior automation engineer is optimizing a playbook that processes large amounts of data. The playbook uses the "json_query" filter to filter and extract specific fields from a complex JSON structure returned by an API. The engineer notices that the playbook runs very slowly and consumes a lot of memory. They suspect the json_query filter is inefficient for this use case. The engineer wants to replace json_query with a combination of built-in Ansible filters to improve performance. The JSON structure is as follows:
{
  "servers": [
    {"name": "web01", "status": "active", "role": "web"},
    {"name": "web02", "status": "active", "role": "web"},
    {"name": "db01", "status": "active", "role": "db"}
  ]
}
The engineer needs to extract a list of server names where the status is "active" and the role is "web". The current code using json_query is:
server_names: "{{ api_result | json_query(\"servers[?status=='active' && role=='web'].name\") }}"
Which of the following alternatives uses only Ansible built-in filters (not json_query) and is likely to be more efficient?

Accepted Answer

server_names: "{{ api_result.servers | selectattr('status', '==', 'active') | selectattr('role', '==', 'web') | map(attribute='name') | list }}". Option A is correct. It uses selectattr twice to filter by status and role, then map to extract names. This is more efficient because it avoids JMESPath parsing and works directly on Python objects. Option B uses 'equalto' which is not a valid test operator for selectattr. Option C uses 'is' which is invalid. Option D uses rejectattr with '==' which would exclude the correct items, giving the opposite result.

Answer

server_names: "{{ api_result.servers | rejectattr('status', '==', 'active') | rejectattr('role', '==', 'web') | map(attribute='name') | list }}"

Answer

server_names: "{{ api_result.servers | selectattr('status', 'equalto', 'active') | selectattr('role', 'equalto', 'web') | map(attribute='name') | list }}"

Answer

server_names: "{{ api_result.servers | selectattr('status', 'is', 'active') | selectattr('role', 'is', 'web') | map(attribute='name') | list }}"

Question 2

You are an Ansible Tower administrator for a company that uses a dynamic inventory script to pull hosts from AWS. The script has been working for months, but after a recent security update, the job template that uses this inventory fails with the error: 'ERROR! Unable to parse /path/to/inventory/script.py as an inventory source'. The script is executable and the path is correct. What is the most likely cause?

Accepted Answer

The required Python modules (e.g., boto3) are missing in the Tower virtual environment.. The error 'Unable to parse /path/to/inventory/script.py as an inventory source' typically occurs when the dynamic inventory script fails to execute properly. Since the script is executable and the path is correct, the most likely cause is that the required Python modules (e.g., boto3 for AWS) are missing in the Ansible Tower virtual environment. Tower runs inventory scripts in its own Python virtual environment, and if boto3 is not installed there, the script cannot import it and fails, leading to the parse error.

Answer

The inventory source type has been changed to 'Manual' instead of 'Scraped from project'.

Answer

The script has been deleted from the project directory.

Answer

The script lacks execute permissions for the Tower service user.

Question 3

Your organization uses Ansible Tower to manage a growing number of Linux servers. Currently, there is a single inventory called 'All Servers' that contains all hosts. A new project requires that certain sensitive variables (e.g., API keys) be stored securely and not exposed in job logs. The security team also wants to limit which users can use these credentials. You have been asked to implement a solution. After evaluating, you plan to create a custom credential type with a 'password' field for the API key and assign it to the job template. However, during a test run, the API key is still visible in the job output. What is the most likely reason?

Accepted Answer

The playbook contains a debug task that prints the API key variable.. Option B is correct because even if a credential is properly defined and assigned, any task in the playbook that explicitly references the variable (such as a debug task) will output its value in the job log. Ansible Tower's credential hiding only prevents the credential from being displayed in the job template's 'extra variables' or credential details; it does not automatically suppress the variable's value if the playbook itself prints it. The playbook author must use the 'no_log: true' directive on tasks that handle sensitive data to prevent exposure.

Answer

The custom credential type was created with an 'input' field instead of a 'password' field.

Answer

The 'no_log' parameter was not set in the Ansible configuration for the module.

Answer

The credential was not assigned to the job template; it was only assigned to the project.

Question 4

An Ansible Tower administrator notices that a job template fails intermittently with a 'Host unreachable' error for a specific group of servers. The inventory is static and the host entries have correct IPs. The credential used for SSH is a machine credential with a username and password, and it works for other hosts. Upon checking the job output, the error occurs during the 'Gathering Facts' step. The SSH service on these servers is running and reachable from the Tower node. What is the most likely cause?

Accepted Answer

The credential's SSH private key has a passphrase that is not stored in the credential.. Option A is correct because the error occurs during the 'Gathering Facts' step, which uses SSH to connect to the managed hosts. If the SSH private key has a passphrase that is not stored in the credential, Ansible Tower cannot decrypt the key to authenticate, causing a 'Host unreachable' error even though the host is actually reachable. The credential works for other hosts only if those hosts are configured to accept password-based authentication, but the failing hosts may require key-based authentication, exposing the missing passphrase.

Answer

The credential type should be 'network' instead of 'machine' for these servers.

Answer

The inventory group has hosts defined with incorrect hostnames in the ansible_host variable.

Answer

The SSH service on these servers is bound to a different port than the default 22.

Question 5

A systems administrator is performing a rolling update of a three-node Red Hat Enterprise Linux 8 cluster running a load-balanced web application. The update involves upgrading the httpd package. The administrator uses Ansible to update one node at a time. After updating the first node, the administrator checks the application health and finds that the node is serving requests correctly. The administrator proceeds to update the second node. However, after the second node update completes, the load balancer reports that both the first and second nodes are unavailable. What is the most likely cause?

Accepted Answer

The second node's update triggered a configuration change that disabled the health check endpoint on both nodes.. Option C is correct because the update on the second node may have triggered a configuration change (e.g., via a shared config file or package dependency) that also affected the health check endpoint on the first node. Option A is wrong because if the first node were excluded, it would have been unavailable immediately after its update. Option B is wrong because a segmentation fault is unlikely to affect both nodes simultaneously. Option D is wrong because load balancers typically do not limit active nodes to one; they manage pools of multiple nodes.

Answer

The httpd service on both nodes experienced a segmentation fault after the update.

Answer

The first node was inadvertently excluded from the load balancer pool by the Ansible playbook.

Answer

The load balancer was configured to only allow one node to be active at a time.

Question 6

You are managing a critical web application deployed on OpenShift with 12 replicas. The application must maintain at least 10 replicas available during updates to meet an SLA. You initiate a rolling update using the default strategy, but the rollout is progressing slowly because only 2 new pods are created at a time, causing a prolonged update duration. You need to speed up the rollout without violating the SLA (10 available replicas). The current Deployment configuration has maxSurge: 25% (3 pods) and maxUnavailable: 25% (3 pods). You have permission to update the DeploymentConfig during the active rollout. Which action should you take?

Accepted Answer

Set maxSurge to 10 and maxUnavailable to 2, then run 'oc rollout resume'.

Answer

Cancel the current rollout, set maxSurge to 4 and maxUnavailable to 2, then start a new rollout.

Answer

Set maxSurge to 50% and maxUnavailable to 50%, then run 'oc rollout resume'.

Answer

Set maxSurge to 5 and maxUnavailable to 2, then run 'oc rollout retry'.

Question 7

A DevOps engineer is responsible for coordinating a rolling update of a Red Hat OpenShift Container Platform 4.12 cluster with 10 worker nodes. The cluster hosts a stateful application that uses persistent volumes with ReadWriteOnce access mode. The update involves a minor version upgrade of the cluster from 4.12.0 to 4.12.5. The engineer uses the recommended `oc adm upgrade` command. During the update, after the first worker node is updated, the engineer notices that the node's status shows 'NotReady' and the cluster version operator reports a degraded status. A check of the node logs reveals 'kubelet: Failed to run kubelet: Could not get kubelet config from cluster: could not get config from cluster: context deadline exceeded'. Which action should the engineer take first?

Accepted Answer

Check the network connectivity between the updated node and the control plane nodes on port 6443.. Option B is correct because the error indicates the kubelet cannot communicate with the control plane on port 6443, likely due to a network issue (e.g., firewall, DNS, or routing). Option A is wrong because rolling back the entire cluster is a drastic first step; the issue is likely isolated. Option C is wrong because changing kubelet parameters is not a standard resolution for connectivity problems. Option D is wrong because rebuilding the node from scratch is unnecessary and time-consuming; the issue is likely resolvable by restoring network connectivity.

Answer

Rebuild the node from scratch using the machine config operator.

Answer

Roll back the entire cluster to version 4.12.0 using the `oc adm upgrade --to=4.12.0` command.

Answer

Increase the kubelet's `--node-status-update-frequency` parameter on the updated node.

Question 8

Your organization uses Red Hat Ansible Automation Platform (AAP) to manage job execution. You have created a job template that runs a playbook to configure application servers. The playbook uses a custom credential to access a remote database. Recently, the job started failing with 'Authentication failed' when connecting to the database. You have verified that the database credentials are correct. The credential in AAP is of type 'Machine' and is assigned to the job template. The playbook uses the 'mysql_db' module. Which step should you take to troubleshoot and resolve the issue?

Accepted Answer

Change the credential type to 'Database' and provide the appropriate username and password.. Option B is correct because the 'mysql_db' module typically requires a database credential type, not a machine credential. The credential type must match the module's needs. Option A is incorrect because extra variables would override inventory but not fix the credential type. Option C is incorrect because the vault provides a different mechanism; the credential type is the core issue. Option D is incorrect because the issue is not about SSH keys.

Answer

Add the database password as an extra variable in the job template.

Answer

Modify the machine credential to include the database password as an SSH key.

Answer

Encrypt the database password using Ansible Vault and include it in the playbook.

Question 9

You are responsible for managing a large fleet of web servers running Red Hat Enterprise Linux 8. You have an Ansible playbook that deploys a custom web application. The playbook uses several roles from Ansible Galaxy and includes tasks that require root privileges. Recently, users reported that the deployment fails intermittently with the error 'Timeout (12s) waiting for privilege escalation prompt'. You suspect that the issue is related to the become method and the SSH connection. The current inventory uses 'ansible_user: deploy' and 'ansible_become: yes' with default settings. The 'deploy' user has sudo privileges with NOPASSWD for all commands. However, the timeout occurs only on high-latency connections. Which change would most effectively resolve the timeout issue?

Accepted Answer

Increase the 'timeout' setting in ansible.cfg to 30 seconds.. Option C is correct because increasing the 'timeout' parameter in ansible.cfg (or setting ANSIBLE_TIMEOUT) gives more time for privilege escalation prompts on slow connections. Option A is incorrect because SSH pipelining can reduce round trips but does not directly address the timeout. Option B is incorrect because parallel execution increases load and may exacerbate timeouts. Option D is incorrect because the error indicates a privilege escalation timeout, not a missing password.

Answer

Increase 'forks' to 20 to run more tasks in parallel.

Answer

Enable pipelining by setting 'pipelining = True' in ansible.cfg.

Answer

Set 'ansible_become_password' in the inventory.

Question 10

You need to run an Ansible playbook every hour to update a dynamic inventory file from a CMDB API. The playbook is stored in /opt/ansible/update_inventory.yml. You want to schedule the execution using a cron job on the control node. The control node runs Red Hat Enterprise Linux 9. The playbook uses Ansible Vault to decrypt API credentials, and the vault password is stored in /etc/ansible/.vault_pass. Which cron entry will execute the playbook hourly?

Accepted Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml. Option A is correct because it specifies the correct cron schedule (0 * * * * for hourly) and uses full paths to ansible-playbook, vault password file, and playbook. Option B uses the wrong schedule (every minute). Option C uses ansible command instead of ansible-playbook. Option D has an incorrect path for the vault password file.

Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file ~/.vault_pass /opt/ansible/update_inventory.yml

Answer

* * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Answer

0 * * * * /usr/bin/ansible --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Question 11

You are an automation engineer at a large enterprise. The company uses Ansible Automation Platform 2.x and has a private Automation Hub server. The security team mandates that all execution environments must be built from a hardened base image that has been approved by the security team. The base image is stored in a private container registry at registry.internal.company.com/hardened-ee:latest. You need to create an execution environment that includes a custom collection 'company.tools' which is hosted on the private Automation Hub. Additionally, the execution environment must include the Python library 'cryptography' version 3.4.8. You have created the following files:

execution-environment.yml:
---
version: 3
images:
  base_image:
    name: registry.internal.company.com/hardened-ee:latest
options:
  package_manager_path: /usr/bin/microdnf
dependencies:
  galaxy: requirements.yml
  python: requirements.txt

requirements.yml:
---
collections:
  - name: company.tools
    source: https://automationhub.company.com/api/galaxy/content/private/

requirements.txt:
cryptography==3.4.8

When you run 'ansible-builder build -f execution-environment.yml', the build fails with an error: 'Error: Failed to resolve dependency cryptography==3.4.8'. Based on this scenario, what is the most likely cause of the failure?

Accepted Answer

The base image already includes cryptography but not version 3.4.8, causing a version conflict.. Option B is correct because the error 'Failed to resolve dependency cryptography==3.4.8' indicates a version conflict with the Python cryptography library already present in the hardened base image. The base image likely includes a different version of cryptography, and pip cannot satisfy the pinned version constraint due to conflicts with the pre-installed package. Ansible Builder uses pip to install Python dependencies, and if the base image has a conflicting version, the build fails unless the dependency is unpinned or the base image is adjusted.

Answer

The requirements.yml file has an incorrect source URL for the private Automation Hub.

Answer

The execution-environment.yml is missing the 'system' dependency section for bindep.txt.

Answer

The package_manager_path should be /usr/bin/dnf instead of microdnf.

Question 12

You have an Ansible playbook that uses the 'lineinfile' module to manage the /etc/ssh/sshd_config file. The playbook runs without errors, but after execution, the SSH service becomes unreachable on some hosts. Investigation reveals that the file contains duplicate lines for 'Port 22' and 'PermitRootLogin no'. The playbook uses the following task:

- name: Ensure SSH settings
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^{{ item.key }}"
    line: "{{ item.key }} {{ item.value }}"
  loop:
    - { key: 'Port', value: '22' }
    - { key: 'PermitRootLogin', value: 'no' }

The playbook is run multiple times. What is the most likely cause of the duplicate lines?

Accepted Answer

The regexp pattern does not match the existing lines exactly, causing new lines to be added instead of replacing.. Option A is correct because the regexp pattern `^{{ item.key }}` matches only the start of a line (e.g., `^Port` or `^PermitRootLogin`), but the existing lines in `/etc/ssh/sshd_config` may have leading spaces or tabs (common in SSH config files). Since the regex does not match the actual line due to whitespace, the `lineinfile` module inserts a new line instead of replacing the existing one. Each playbook run adds another duplicate, eventually causing SSH to fail due to conflicting directives.

Answer

The 'lineinfile' module is not idempotent when used with loops.

Answer

The loop should use 'with_items' instead of 'loop' for proper idempotence.

Answer

The 'line' parameter should use backreferences to avoid duplication.

Question 13

You are managing a rolling update of a 10-node web application cluster using Ansible. The application requires that at least 8 nodes remain available during the update to handle traffic. You have written a playbook that uses serial: 2 (updates 2 nodes at a time). During a test run, the playbook updates the first batch of 2 nodes successfully, but when it proceeds to the second batch, one of the nodes fails to restart the web service. However, the playbook continues and updates the remaining nodes. At the end, only 7 nodes are healthy, causing performance degradation. You need to ensure that if a batch fails to meet the minimum health requirements, the entire rollout is stopped and no further updates are applied. Which course of action should you take?

Accepted Answer

Use the 'throttle' keyword with a rolling update strategy that includes a post-task health check and set max_fail_percentage to a value that aborts if the healthy node count drops below 8.. Option C is correct because it uses the `throttle` keyword with a rolling update strategy that includes a post-task health check and sets `max_fail_percentage` to abort the playbook if the healthy node count drops below 8. This ensures that if a batch fails to meet the minimum health requirements, the entire rollout is stopped and no further updates are applied, preventing performance degradation.

Answer

Add a retry loop to the service restart task with a delay and count of 5.

Answer

Set ignore_errors: yes on the service restart task to avoid failures stopping the playbook.

Answer

Increase serial to 3 to complete the update faster and reduce the chance of node failures.

Question 14

A company manages its infrastructure using Ansible Tower. There are two teams: Team Alpha manages web servers in the 'webservers' group, and Team Beta manages database servers in the 'dbservers' group. Both teams need to use the same SSH credential to connect to their respective servers. The credential is stored in Tower as 'shared_ssh_key'. Team Alpha reports that they can launch jobs against the 'webservers' group, but Team Beta gets an error when trying to launch jobs against the 'dbservers' group: 'You do not have permission to use this credential.' Both teams are members of the same organization. The inventory is a single inventory source with separate groups. The credential has been assigned to the organization. What is the most likely cause of Team Beta's issue, and what is the correct solution?

Accepted Answer

Grant Team Beta the 'Use' role on the credential 'shared_ssh_key'.. In Ansible Tower, credentials are assigned to an organization, but users or teams must be explicitly granted the 'Use' role on a credential to be able to use it in a job template. Team Alpha can use the credential because they likely have the 'Use' role, while Team Beta does not. Granting Team Beta the 'Use' role on 'shared_ssh_key' resolves the permission error.

Answer

Create a new credential with the same SSH key and assign it to Team Beta.

Answer

Assign the credential to the dbservers group in the inventory.

Answer

Move the credential from the organization to the project level.

Question 15

You are deploying Red Hat Ansible Automation Platform in a restricted network environment where the automation controller, automation hub, and execution nodes cannot access the internet. You have successfully installed the automation controller and automation hub on separate RHEL 8 servers using a local repository. The automation hub is configured to sync collections from a local mirror. After deployment, you attempt to create a new job template that uses a collection from automation hub, but the job template creation fails with the error: 'Failed to find collection' for a collection that exists in automation hub. The execution nodes are subscribed to the same local repository. The automation controller is configured with the automation hub as the default collections server. What is the most likely cause?

Accepted Answer

The automation controller is configured with the default cloud.redhat.com as the collections server instead of the local automation hub URL.. Option D is correct because the automation controller must be explicitly configured to use the local automation hub as the default collections server. If it defaults to cloud.redhat.com, the controller will attempt to download collections from the internet, which fails in a restricted network environment. The error 'Failed to find collection' indicates the controller cannot reach the configured collections server, not that the collection is missing from the local hub.

Answer

The local repository does not contain the required Ansible Automation Platform packages for the execution nodes.

Answer

The automation controller cannot communicate with the execution nodes due to network restrictions.

Answer

The execution nodes are not registered with the automation controller.