EX294 Practice Test 4 — 10 Questions

Question 1

You are managing a large infrastructure of 500 Linux servers. The servers are divided into groups: 'web', 'app', and 'db'. Each group has specific configuration requirements. You have developed a set of Ansible roles to manage these configurations. Recently, you noticed that when you run the playbook against all servers, the 'web' role is applied to 'app' servers due to a variable misconfiguration. The playbook uses include_role with a variable that determines which role to apply. The variable is defined in group_vars/all.yml as 'server_role: web'. However, each group should have its own role: 'web' for web servers, 'app' for app servers, 'db' for db servers. The playbook includes the role based on '{{ server_role }}'. What is the best course of action to fix this issue without modifying the playbook structure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the server_role variable in group_vars/web.yml, group_vars/app.yml, and group_vars/db.yml with the appropriate values.. Ansible's variable precedence dictates that group_vars/<group_name>.yml files override group_vars/all.yml for hosts in that group. By defining `server_role` per group file (web, app, db), each server gets the correct role without modifying the playbook structure. This leverages Ansible's built-in group variable inheritance to resolve the misconfiguration cleanly.

Answer

Change the variable in group_vars/all.yml to a list and use 'include_role' with loop.

Answer

Add a 'when' condition to the include_role task to check the group name.

Answer

Define the server_role in host_vars for each server.

Question 2

Refer to the exhibit. An Ansible playbook targeting server1 fails with a permissions error when connecting. The administrator notices the SSH private key is being used. Which change will likely fix the issue?

Accepted Answer

Change ansible_user to 'ec2-user'.. The error indicates that the SSH private key being used does not correspond to the user attempting to connect. In many cloud environments like AWS, the default user for Amazon Linux 2 is 'ec2-user', and the SSH private key is tied to that user. Changing `ansible_user` to 'ec2-user' ensures the correct user context for key-based authentication, resolving the permissions error.

Answer

Add `ansible_become: yes` to the playbook.

Answer

Remove ansible_ssh_common_args.

Answer

Set ansible_ssh_private_key_file to a different key.

Question 3

When building an execution environment with ansible-builder, a developer notices that the build process fails with an error about missing dependencies. The developer wants to ensure all required Python packages are installed in the execution environment. Which file should be used to specify additional Python packages?

Accepted Answer

requirements.txt. In Ansible Builder, the `requirements.txt` file is used to specify additional Python packages that should be installed in the execution environment. When building an execution environment, Ansible Builder reads this file and installs the listed packages via pip, ensuring all required Python dependencies are present.

Answer

meta/runtime.yml

Answer

galaxy.yml

Answer

bindep.txt

Question 4

A developer creates a collection and wants to ensure it includes a required Python library for a module. Where should this dependency be declared?

Accepted Answer

In the galaxy.yml file under dependencies.. In Ansible collections, Python library dependencies for modules are declared in the `galaxy.yml` file under the `dependencies` key. This ensures that when the collection is installed via `ansible-galaxy collection install`, the required Python packages are automatically resolved and installed. The `dependencies` field in `galaxy.yml` specifically supports listing Python package requirements using the format `python: package_name`.

Answer

In a requirements.txt file at the collection root.

Answer

In the meta/runtime.yml file.

Answer

In the collection's README.

Question 5

In OpenShift, a deployment must gradually shift traffic to new pods during a rolling update. Which default strategy achieves this?

Accepted Answer

RollingUpdate. The RollingUpdate strategy is the default deployment strategy in OpenShift (and Kubernetes) that gradually replaces old pods with new ones while maintaining application availability. It achieves this by incrementally scaling down the old ReplicaSet and scaling up the new one, controlled by parameters like maxSurge and maxUnavailable, ensuring a smooth transition of traffic to new pods.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Custom strategy

Answer

Recreate

Question 6

Refer to the exhibit. The administrator observes the output and is concerned because the 'Check on async job' task shows 'finished: 0'. What does this indicate?

Accepted Answer

The async job is still running.. In the context of ansible async jobs, 'finished: 0' indicates that the job has not completed yet and is still running. A value of '1' would mean the job finished. Therefore, the administrator's concern that the job shows 'finished: 0' is correct because it means the task is still in progress.

Answer

The async job was not started.

Answer

The async job failed.

Answer

The async job has completed successfully.

Question 7

You are managing a fleet of 200 RHEL 8 servers with Ansible Tower. A playbook uses the 'seboolean' module to enable httpd_can_network_connect for a web application. Recently, the playbook has been failing on 10 servers with the error: 'Failed to set SELinux boolean: Unable to communicate with SELinux policy'. Other servers succeed. The playbook runs as the 'ansible' user with passwordless sudo. The failing servers have identical SELinux configuration (enforcing mode, targeted policy) and the same package versions as working servers. You suspect the issue is related to the 'python3-libselinux' package. Which of the following is the most likely cause and the correct fix?

Accepted Answer

The 'python3-libselinux' package is missing on the failing servers. Install it with 'dnf install python3-libselinux'.. The error 'Failed to set SELinux boolean: Unable to communicate with SELinux policy' indicates that the Python bindings required to interact with the SELinux policy are missing. The 'seboolean' module in Ansible relies on the 'python3-libselinux' package to communicate with the SELinux subsystem. Since the playbook runs as the 'ansible' user with passwordless sudo, and the failing servers have identical SELinux configuration and package versions except for this missing dependency, installing 'python3-libselinux' resolves the issue.

Answer

The 'python2-libselinux' package is required because Ansible uses Python 2. Install it with 'dnf install python2-libselinux'.

Answer

The 'ansible' user lacks sudo access to the 'seboolean' command. Add a sudoers entry to allow it.

Answer

The 'libsemanage' package is missing. Install it with 'dnf install libsemanage'.

Question 8

An admin checks the job details and sees this error from the API. What is the most likely cause?

Accepted Answer

The callback plugin is not installed on the controller node.. The error from the API indicates that the callback plugin is missing on the controller node. In Ansible Automation Platform, callback plugins must be installed on the controller node (or execution node) where `ansible-runner` processes job events. If the plugin is not present there, the API will report a failure when the job attempts to use it, even if the execution environment contains the plugin.

Answer

The job template is using an execution environment that lacks the plugin.

Answer

The callback plugin name is misspelled in the project.

Answer

The machine credential is invalid.

Question 9

The build fails with a DNS resolution error for `registry.redhat.io`. Which troubleshooting step is most likely to resolve the issue?

Accepted Answer

Verify DNS settings in `/etc/resolv.conf` or configure a custom DNS server for the container runtime.. A DNS resolution error for `registry.redhat.io` indicates that the container runtime (e.g., Podman) cannot resolve the registry's hostname to an IP address. This is a network/DNS issue, not an authentication or caching problem. Verifying or correcting DNS settings in `/etc/resolv.conf` or configuring a custom DNS server for the container runtime directly addresses the root cause by ensuring the host or container runtime can resolve the registry's FQDN.

Answer

Run `podman login registry.redhat.io` to authenticate.

Answer

Restart the container runtime service.

Answer

Use the `--no-cache` flag to force a fresh build.

Question 10

An administrator has a playbook with tasks tagged 'install', 'configure', and 'service'. There are no untagged tasks. They want to run only the tasks tagged 'install' and 'configure', skipping 'service'. Which three commands will achieve this? (Choose three.)

Accepted Answer

ansible-playbook site.yml --tags install,configure. Options A, C, and E are correct. Option A uses a comma-separated list with `--tags` to run tasks tagged 'install' or 'configure'. Option C uses `--skip-tags service` to exclude the 'service' tag, running all other tags (install and configure). Option E uses multiple `--tags` options, which Ansible combines with OR logic, effectively running tasks matching either 'install' or 'configure'. Options B and D are incorrect: B runs only 'configure' tasks (since it skips install and service), and D runs only 'install' tasks (since it specifies only that tag and skips service).

Answer

ansible-playbook site.yml --tags configure --skip-tags install,service

Answer

ansible-playbook site.yml --tags install --skip-tags service