EX294 Practice Test 6 — 10 Questions

Question 1

Match each firewall zone to its default behavior.

Accepted Answer

public: Rejects incoming traffic except for explicitly allowed services.. Common firewalld zones include public (default deny), trusted (allow all), external (NAT with limited inbound), dmz (limited inbound for public servers), internal (trusted but filtered), and drop (silent discard). Common confusions involve swapping the behaviors of public and trusted, or misunderstanding dmz as fully blocking instead of selectively allowing.

Answer

internal: Allows all incoming traffic from any source.

Answer

dmz: Drops all incoming traffic.

Question 2

Which THREE of the following are valid ways to define host variables in an Ansible inventory? (Choose exactly three.)

Accepted Answer

Inline in the inventory file, e.g., 'myhost ansible_host=192.168.1.1 http_port=8080'.. Ansible allows inline host variable definitions directly in the inventory file using key=value pairs after the hostname. This is a standard syntax where variables like 'http_port=8080' are assigned to the host 'myhost' and become available as Ansible facts during playbook execution. The 'ansible_host' special variable is also defined this way to override the connection address.

Answer

In the 'extra_vars' field of the job template.

Answer

In a credential's 'Input Configuration' as a secret variable.

Question 3

Which TWO elements can be used to include external task files in a playbook?

Accepted Answer

import_tasks. Both A. import_tasks and B. include_tasks are the two Ansible directives designed to bring external task files into a playbook, which is exactly what the scenario asks for. import_tasks is processed statically at playbook parse time, so the referenced YAML file's tasks are inserted before execution begins, making it suitable for fixed, always-included task lists. include_tasks is processed dynamically at runtime, allowing the included file to be chosen conditionally or looped over, which is useful when the task file depends on variables or facts. The other options do not belong: include_vars loads variables from an external file rather than tasks, add_host dynamically adds a host to the in-memory inventory, and include_role imports a role (which may contain tasks) but is not the directive for including a standalone external task file.

Answer

include_vars

Answer

add_host

Answer

include_role

Question 4

Refer to the exhibit. A user runs a playbook that creates hosts and then attempts to use a constructed inventory plugin. However, the constructed inventory does not group hosts by OS distribution. What is the most likely cause?

Accepted Answer

The constructed inventory runs before add_host tasks, so the hosts are not yet created.. The constructed inventory plugin processes inventory sources and applies Jinja2 conditions to group hosts based on variables. However, when used in a playbook alongside the `add_host` module, the constructed inventory is evaluated at the start of the play, before any tasks (including `add_host`) run. Therefore, hosts added dynamically via `add_host` do not exist when the constructed plugin attempts to group them, causing the groups to be empty. Option C correctly identifies this ordering issue.

Answer

The constructed plugin cannot be used with the add_host module.

Answer

The 'strict: false' setting ignores missing variables, causing the group to be empty.

Answer

The variable ansible_distribution is not defined because gather_facts is set to no.

Question 5

An organization uses Automation Controller with multiple teams. They want to ensure that team members can only launch job templates that are explicitly assigned to their team. Which configuration approach should be used?

Accepted Answer

Create roles and assign them at the job template level using team roles. Automation Controller (formerly Ansible Tower) uses Role-Based Access Control (RBAC) where roles (e.g., Execute, Admin) can be assigned to teams at the job template level. This ensures that only members of a specific team can launch the job templates explicitly assigned to that team, without affecting other teams or requiring organization-wide permissions.

Answer

Assign each team to an organization and set organization-level permissions

Answer

Set 'allow simultaneous' to false on job templates

Answer

Use an Identity Provider (IdP) to restrict access

Question 6

Which TWO statements about Ansible content collections are correct?

Accepted Answer

Collections can be distributed via Automation Hub or Galaxy.. Option C is correct because Ansible content collections can be obtained from both public Ansible Galaxy and Red Hat Automation Hub (as well as private Automation Hub instances), which are the standard distribution sources configured via ansible.cfg or the ansible-galaxy CLI. Option E is correct because a collection's source tree requires a galaxy.yml metadata file at its root, which defines the namespace, name, version, authors, and dependencies used when building and publishing the collection artifact. Option A is wrong because collections can also be installed from Automation Hub, private automation hubs, Git repositories, tarballs, or local paths, not only Galaxy. Option B is wrong because a collection name uses the format namespace.collection (for example, ansible.builtin), so it must include a namespace rather than being a single word. Option D is wrong because collections can contain many content types beyond roles and playbooks, including modules, plugins, filters, tests, and documentation.

Answer

Collections can be installed only from Galaxy.

Answer

The collection name must be a single word without namespace.

Answer

A collection can contain only roles and playbooks.

Question 7

In an Ansible playbook, the 'strategy' parameter is set to 'free'. What behavior does this strategy produce?

Accepted Answer

Each host runs through the playbook independently of other hosts.. The 'free' strategy in Ansible allows each host to run through the playbook independently, without waiting for other hosts to finish the current task. This means a faster host can proceed to subsequent tasks while slower hosts are still working on earlier tasks, maximizing parallelism and reducing overall execution time.

Answer

Playbook runs tasks on hosts in batches of 1.

Answer

Strategy is deprecated and replaced by 'linear'.

Answer

All hosts run the same task at the same time, then move to the next task.

Question 8

Which TWO of the following are advantages of using 'ansible-pull' over 'ansible-playbook'?

Accepted Answer

It can be used in environments where a central control node is not desired.. Option A is correct because ansible-pull is designed for decentralized setups: each managed host runs the ansible-pull command itself, fetching and executing a playbook from a git repository, so no persistent central control node is required to push configurations. Option C is correct because ansible-pull's core behavior is exactly that nodes self-configure by cloning or updating a playbook from a git repository (via the -U/--url option) and then running it locally with ansible-playbook under the hood. Option B is not a real advantage: ansible-pull still relies on an inventory (typically localhost or a local inventory file) to determine targets, so it does not eliminate inventory usage. Option D is false because ansible-pull uses the same YAML playbook syntax as ansible-playbook; there is no separate, more efficient syntax. Option E is misleading: although execution happens locally, ansible-pull does not inherently reduce control-node load as a designed advantage, and the question asks for advantages over ansible-playbook, which is not established by this option.

Answer

It eliminates the need for an inventory file.

Answer

It supports a different syntax for playbooks that is more efficient.

Answer

It reduces load on the control node because it runs locally on each node.

Question 9

An admin needs to restrict which users can launch specific job templates. Which AAP feature should be used?

Accepted Answer

Role-based access control (RBAC) on job templates.. Role-based access control (RBAC) on job templates is the correct feature because it allows an administrator to assign specific permissions (e.g., execute, read, or admin) to users or teams for individual job templates in Ansible Automation Platform (AAP). This directly restricts which users can launch specific job templates without affecting other resources.

Answer

Execution environments with custom modules.

Answer

Machine credentials with different users.

Answer

Inventory groups with host restrictions.

Question 10

A playbook uses import_playbook to include other playbooks. The main playbook is run with --check mode. Which statement is true?

Accepted Answer

Imported playbooks are also run in check mode.. When a playbook uses `import_playbook`, the imported playbooks are statically included at parse time, meaning they become part of the main playbook's play structure. The `--check` mode flag applies to the entire playbook execution, so all imported playbooks also run in check mode. Option D is correct because Ansible propagates the check mode flag to all imported plays.

Answer

Only the main playbook runs in check mode; imported ones run normally.

Answer

All imported playbooks are skipped because import happens at parse time.

Answer

import_playbook does not support check mode.