EX294 Practice Test 6 — 10 Questions

Question 1

Refer to the exhibit. A role 'timezone' sets the timezone twice to different values. The role also depends on 'ntp'. After running a playbook that applies this role to server1, what is the timezone on server1?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

America/New_York

Answer

The timezone is not set because of the dependency on ntp.

Answer

UTC

Answer

An error occurs because two tasks set the timezone.

Question 2

An admin attempts to build an execution environment using the exhibited files. The build fails with an error about incompatible Python dependency. What is the most likely cause?

Accepted Answer

The Python requirements.txt tries to install a version of Ansible that conflicts with the version in the base image.. The build fails because the Python `requirements.txt` file attempts to install a version of Ansible that conflicts with the version already present in the base image `ee-minimal-rhel8`. Execution environments are designed to include a specific Ansible version in the base image; adding a different version via pip creates a dependency conflict that breaks the build.

Answer

The execution-environment.yml file uses incorrect syntax for the 'dependencies' section.

Answer

The collections in requirements.yml are not fully qualified.

Answer

The base image 'ee-minimal-rhel8' is not a valid execution environment base image.

Question 3

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. `ansible-vault` encrypts variable files at rest using AES-256, allowing sensitive data like passwords or API keys to be stored securely in version control. When a playbook runs, the vault password must be provided (e.g., via `--ask-vault-pass` or a vault password file), and Ansible decrypts the file in memory only, never writing plaintext to disk. This ensures that sensitive values are not exposed in the playbook source code or logs.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 4

Refer to the exhibit. A playbook includes this vars file and runs `systemctl restart httpd`. The playbook fails because it cannot decrypt the vault. Which of the following is the most likely cause?

Accepted Answer

The vault password is not provided.. The error 'cannot decrypt the vault' indicates that Ansible is unable to decrypt the vault-encrypted variable file. This occurs when the vault password is not provided via `--ask-vault-pass`, `--vault-password-file`, or the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable. Without the correct password, Ansible cannot decrypt the vault, causing the playbook to fail.

Answer

The vault ID is missing.

Answer

The variable db_password is not used in the playbook.

Answer

The vault file is corrupted.

Question 5

A playbook uses `{{ my_var | default('fallback') }}`. What is the effect?

Accepted Answer

If `my_var` is undefined, the expression evaluates to 'fallback'.. The `default` filter in Ansible (also known as `d()`) returns the specified fallback value only when the variable is undefined. If `my_var` is defined but empty or None, the filter returns the variable's value (empty string or None), not the fallback. This behavior is specific to the `default` filter's default mode; to also catch empty or None values, you must use `default('fallback', true)`.

Answer

If `my_var` is defined but empty, the expression evaluates to 'fallback'.

Answer

If `my_var` is defined but equal to None, the expression evaluates to 'fallback'.

Answer

The filter raises an error because 'default' is not a valid filter.

Question 6

What is the purpose of the 'meta: flush_handlers' task?

Accepted Answer

Force handlers to run immediately. The 'meta: flush_handlers' task in Ansible is used to force any pending handler notifications to run immediately at that point in the play, rather than waiting until the end of the play. This is correct because it ensures that handlers triggered by earlier tasks execute right away, which is essential when subsequent tasks depend on the state changes those handlers make (e.g., restarting a service before configuring it further).

Answer

Restart services immediately

Answer

Clear the handler queue

Answer

Wait for handlers to complete

Question 7

An Ansible playbook includes a role that defines default variables in 'defaults/main.yml' and role variables in 'vars/main.yml'. A playbook sets the same variable in the play's 'vars' section. Which variable value takes precedence?

Accepted Answer

Play vars. In Ansible, variable precedence is hierarchical, and play vars (set directly in the play's `vars` section) have a higher priority than role defaults and role vars. Specifically, play vars override role vars, which in turn override role defaults. Therefore, when the same variable is defined in all three locations, the play vars value takes precedence.

Answer

Role defaults

Answer

Inventory group vars

Answer

Role vars

Question 8

An administrator must parse an inventory file where hostnames are stored in YAML format under a list 'nodes'. The task needs to extract only hostnames that contain 'prod' in the name, then sort them in reverse order. Which combination of filters in a single Ansible expression achieves this?

Accepted Answer

nodes | select('match', '.*prod.*') | sort(reverse=True). The `select` filter with the `match` test returns only list items that match the regex `'.*prod.*'`, i.e., hostnames containing 'prod'. The `sort(reverse=True)` then sorts the resulting list in descending alphabetical order, fulfilling both requirements in a single Ansible expression.

Answer

nodes | regex_search('prod') | sort(True)

Answer

nodes | map('regex_search', 'prod') | sort(reverse=True)

Answer

nodes | reject('match', '.*prod.*') | sort(reverse=True)

Question 9

A team uses Ansible to update a web application across 10 servers with minimal downtime. Which playbook directive achieves one-at-a-time updates?

Accepted Answer

serial: 1. C is correct because the `serial: 1` directive in an Ansible playbook controls the number of hosts that are updated simultaneously. Setting `serial: 1` forces Ansible to execute the playbook on one host at a time, ensuring that the web application is updated sequentially across the 10 servers, which minimizes downtime by keeping the other 9 servers available during each individual update.

Answer

run_once: true

Answer

delegate_to: localhost

Answer

throttle: 1

Answer

forks: 10

Question 10

A workflow template in automation controller consists of three job templates that must run sequentially with different credentials. The first job template uses a machine credential to provision a VM, the second uses a network credential to configure the switch, and the third uses a cloud credential to deploy the application. To secure the credential usage, what should the administrator configure?

Accepted Answer

Set each job template to use the appropriate credential and ensure workflow node permissions are set to 'use credential'.. Each job template can have its own credential defined. The workflow template does not directly hold credentials; it uses the credentials assigned to each job template. Option A (single credential) is not appropriate. Option C (validation rules) does not exist. Option D (assign to workflow) is not possible.

Answer

Create a single credential that covers all three environments.

Answer

Define credential validation rules in the workflow node properties.

Answer

Assign all three credentials to the workflow template directly.