EX294 Practice Questions 2 — 50 Questions

Question 1

A playbook has a dictionary `config` that maps service names to ports. The team wants to iterate over both keys and values in a task. Which filter should be used to convert the dictionary into a list of key-value pairs?

Accepted Answer

dict2items. The `dict2items` filter is the correct choice because it converts a dictionary into a list of key-value pairs, each represented as a dictionary with `key` and `value` keys. This is the standard Ansible filter for iterating over both keys and values in a `loop` within a task, enabling access to `item.key` and `item.value`.

Answer

items2dict

Answer

flatten

Answer

json_query

Question 2

An Ansible Tower administrator notices that a job template using a dynamic inventory source from AWS EC2 is not updating when new instances are launched. The inventory source is set to update on launch. What is the most likely cause?

Accepted Answer

The AWS credential associated with the inventory source is invalid or expired.. Option B is correct because the most likely cause of a dynamic inventory source not updating is that the associated AWS credential is invalid or expired. When the 'update on launch' option is enabled, Ansible Tower attempts to refresh the inventory from the source before each job run. If the credential (e.g., AWS access key ID and secret access key) is no longer valid, the inventory update will fail silently or with an error, and the job will use stale cached data.

Answer

The inventory source cache timeout is set too high.

Answer

The 'update on launch' option is disabled.

Answer

The inventory source is configured as a custom script.

Question 3

Which TWO methods can be used to limit the hosts that a job template runs against when launching a job? (Choose exactly two.)

Accepted Answer

Using the 'LIMIT' field in the job template or at launch time.. Option C is correct because the 'LIMIT' field in Ansible Tower/AWX allows you to restrict the execution of a job template to a specific subset of hosts in the inventory, either by host name, group name, or pattern. This can be set in the job template definition or overridden at launch time, providing flexible targeting without modifying the inventory structure.

Answer

Assigning a specific credential to the job template.

Answer

Using the 'Tags' field to include only certain tasks.

Answer

Setting the 'Source Control Branch' in the project.

Question 4

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Option C is correct because Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 5

Which TWO statements about inventory groups in Ansible Automation Platform are correct? (Choose exactly two.)

Accepted Answer

A host can belong to multiple groups. Options B and D are correct. A is wrong because groups can contain other groups (nested groups). C is wrong because host variables can be defined at the group level. E is wrong because smart inventories are a separate type, not a dynamic source.

Answer

Host variables are the only way to define variables for a host

Answer

Groups cannot be members of other groups

Answer

Dynamic inventory sources cannot produce groups

Question 6

An organization has multiple inventories for different environments. They want to reuse a set of hosts across inventories without duplicating host definitions. Which feature should they use?

Accepted Answer

Smart inventories. Option D is correct because Smart inventories allow dynamic grouping of hosts from multiple sources based on filters. Option A is incorrect because groups are within a single inventory. Option B is incorrect because inventory sources populate a single inventory. Option C is incorrect because there is no 'shared inventory' feature.

Answer

Inventory sources

Answer

Shared inventories

Answer

Inventory groups

Question 7

An Ansible Tower administrator needs to add a single host to an existing inventory. The host has a static IP address and requires SSH access with a specific username and private key. Which of the following is the correct approach?

Accepted Answer

Navigate to the inventory, click 'Add Host', enter the hostname and IP, and optionally define variables. Then create a credential for SSH and associate it with the host through a job template.. Option D is correct because in Ansible Tower, a host is added to an inventory via the 'Add Host' form, where you enter the hostname and IP address and optionally define variables. SSH credentials are not directly associated with a host; instead, they are created separately and then linked to the host through a job template, which uses the credential to authenticate when running playbooks against that host.

Answer

Add the host to an inventory group using the 'Add Group' option and specify the host details there.

Answer

Use the 'Add Host' form and in the 'Credentials' field, select the appropriate SSH credential from the drop-down.

Answer

Create a new credential first, then add the host directly within the credential definition.

Question 8

An Ansible Tower administrator needs to create a custom credential type that uses an SSH private key and a username. Which THREE components should be defined in the credential type's configuration?

Accepted Answer

"fields": [{"id": "ssh_key_data", "type": "string", "label": "SSH Private Key", "multiline": true, "secret": true}]. Option A is correct because the SSH private key must be defined as a field with `"type": "string"`, `"multiline": true` (since SSH keys are multi-line), and `"secret": true` (to encrypt the value in the database). This matches the standard Ansible Tower custom credential type schema for storing sensitive key material.

Answer

"fields": [{"id": "password", "type": "string", "label": "Password"}]

Answer

"fields": [{"id": "key_type", "type": "string", "label": "Key Type"}]

Question 9

A system administrator maintains a dynamic inventory script that queries a cloud provider API to build host lists. The script returns valid JSON, but after importing into Ansible Tower, the inventory shows zero hosts. The script is executable and placed in the expected project directory. What is the most likely cause?

Accepted Answer

The script has not been added as an inventory script in Ansible Tower's inventory scripts settings.. Option C is correct because Ansible Tower requires that a dynamic inventory script be explicitly registered as an inventory script in the Tower UI under 'Inventories' → 'Scripts'. Even if the script is executable and returns valid JSON, Tower will not execute it unless it is configured as a custom inventory script source. The script must be added via the 'Add' button in the Inventory Scripts section, where Tower will then use it to populate the inventory.

Answer

The script does not output JSON in the correct format expected by Ansible Tower.

Answer

The script does not have the executable permission set.

Answer

The script is written in a language that Ansible Tower does not support.

Question 10

An administrator needs to restrict access to an inventory so that only members of the 'WebTeam' can update its host variables and group memberships. Other users should be able to view the inventory but not modify it. Which role-based access control (RBAC) configuration should be applied?

Accepted Answer

Assign the 'WebTeam' the 'admin' role on the inventory and others the 'read' role. Option C is correct because in Ansible Tower/AWX, the 'admin' role on an inventory grants full update permissions (including host variables and group memberships), while the 'read' role provides view-only access. This directly satisfies the requirement that only WebTeam members can modify the inventory, and others can only view it.

Answer

Create a job template and assign 'WebTeam' the 'execute' role

Answer

Make the 'WebTeam' organization administrators and assign others the 'read' role on the organization

Answer

Assign the 'WebTeam' the 'use' role on the inventory and others the 'read' role

Question 11

A sysadmin receives an error when running a job template: 'ERROR! the role 'common' was not found in the specified roles path'. The role exists in a source control repository referenced in the project. What is the most likely cause?

Accepted Answer

The project's source control sync failed, so the roles directory is empty. Option A is correct because the project sync may have failed, causing the roles directory to be missing. Option B is wrong because the credential type does not affect role availability. Option C is wrong because the inventory host list does not contain role definitions. Option D is wrong because the job template schedule does not impact role discovery.

Answer

The inventory does not include the target hosts

Answer

The job template is configured with an incorrect schedule

Answer

The credential used does not have access to the source control repository

Question 12

An organization has multiple Ansible Tower projects that use different cloud providers. The security team mandates that cloud API credentials stored in Tower must have restricted access and be reusable across job templates without exposing the secret key. Which credential type and organization strategy best meets these requirements?

Accepted Answer

Create separate custom credential types for each cloud provider, marking the secret key fields as 'password' type, and add them to each job template as needed.. Option B is correct because Ansible Tower's custom credential types allow you to define fields with the 'password' type, which encrypts the secret key and hides it from view after entry. By creating separate custom credential types for each cloud provider, you can assign them to specific job templates, ensuring restricted access and reusability without exposing the secret key. This approach meets the security mandate by isolating credentials per provider and leveraging Tower's built-in encryption for sensitive fields.

Answer

Use a network credential to store the API token and assign it to the project.

Answer

Create a single custom credential type that includes both cloud provider API keys and reuse it across all projects.

Answer

Use a machine credential for each cloud provider and set the SSH key as the API secret.

Question 13

A team uses Ansible to update a web application across 10 servers with minimal downtime. Which playbook directive achieves one-at-a-time updates?

Accepted Answer

serial: 1. C is correct because the `serial: 1` directive in an Ansible playbook controls the number of hosts that are updated simultaneously. Setting `serial: 1` forces Ansible to execute the playbook on one host at a time, ensuring that the web application is updated sequentially across the 10 servers, which minimizes downtime by keeping the other 9 servers available during each individual update.

Answer

run_once: true

Answer

delegate_to: localhost

Answer

throttle: 1

Answer

forks: 10

Question 14

An OpenShift deployment is stuck in a degraded state after a rolling update. Which command helps diagnose the root cause by showing status conditions?

Accepted Answer

oc describe deployment/myapp. Option E is correct because `oc describe deployment/myapp` displays the full status conditions of the Deployment, including `Progressing`, `Available`, and `ReplicaFailure` conditions. When a rolling update leaves the Deployment in a degraded state, the `Conditions` field under `Status` explicitly shows the reason (e.g., `ProgressDeadlineExceeded` or `MinimumReplicasUnavailable`), which directly points to the root cause of the degradation.

Answer

oc rollout history

Answer

oc get pods

Answer

oc logs deployment/myapp

Answer

oc get events

Question 15

An Ansible rolling update playbook includes 'max_fail_percentage: 20'. If more than 20% of hosts fail during any batch, what happens?

Accepted Answer

The play aborts immediately

Answer

The play pauses and waits for user input

Answer

The failed hosts are removed from inventory

Answer

The play retries failed hosts

Answer

The play continues with remaining hosts

Question 16

A company wants to implement a rolling update for a stateful application where hosts cannot be updated in parallel due to data consistency. They also need to ensure that if any host fails, the entire update is rolled back. Which strategy meets these requirements?

Accepted Answer

Use serial: 1 and any_errors_fatal: yes. serial: 1 ensures one host at a time; any_errors_fatal: true causes the playbook to stop on first failure on any host, allowing rollback. The other options either allow parallel updates or don't stop on failure.

Answer

Use serial: 2 and any_errors_fatal: yes

Answer

Use serial: 1 and ignore_errors: yes

Answer

Use serial: 0 and max_fail_percentage: 0

Question 17

In OpenShift, a deployment must gradually shift traffic to new pods during a rolling update. Which default strategy achieves this?

Accepted Answer

RollingUpdate

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Custom strategy

Answer

Recreate

Question 18

Which TWO options are valid techniques for rolling out updates to a subset of hosts before updating the rest? (Choose exactly two.)

Accepted Answer

Use serial: 3 to update hosts in batches of 3.. Canary deployments and serial batches are common techniques. Rolling update by serial is inherent in Ansible. Random selection is not a controlled technique.

Answer

Use inventory host variables to mark hosts for early update and use conditional tasks.

Answer

Use the --forks=1 option to update one host at a time.

Answer

Use the 'strategy: random' directive in the playbook.

Question 19

An Ansible rolling update playbook has 'serial: 1' and 'max_fail_percentage: 0'. During the update of a 5-host group, the first host fails. What is the outcome?

Accepted Answer

The play aborts immediately

Answer

The play pauses for manual intervention

Answer

The play retries the failed host

Answer

The play continues with the remaining 4 hosts

Answer

The play marks the host as unreachable and continues

Question 20

An operations team is planning a rolling update of a production OpenShift cluster running Red Hat Enterprise Linux CoreOS nodes. Which three practices should be followed to ensure minimal downtime and proper rollback capability?

Accepted Answer

Use canary nodes to validate the update before full rollout.. Option A is correct because `oc adm update` is the standard command for orchestrating updates. Option C is correct because a maximum surge of 25% prevents resource exhaustion and ensures controlled rollout. Option E is correct because canary nodes allow validation before full rollout. Option B is wrong because placing nodes in the same AZ is not necessary and may reduce resilience. Option D is wrong while monitoring is important, it is not a rolling update practice for minimizing downtime or rollback capability.

Answer

Monitor cluster health via `oc get clusterversion` after each node update.

Answer

Place nodes in the same Availability Zone to simplify rollback.