EX294 Practice Test 7 — 10 Questions

Question 1

Refer to the exhibit. A user includes this in the execution-environment.yml. The build process fails because the second collection cannot be resolved. What is the most likely reason?

Accepted Answer

The source URL is not a valid Galaxy server endpoint.. The execution-environment.yml references a Galaxy server endpoint that is not a valid Ansible Galaxy server. Ansible Builder resolves collections from Galaxy servers, and if the URL does not point to a recognized Galaxy API endpoint (e.g., https://galaxy.ansible.com), the build process cannot fetch the collection. The error indicates the second collection cannot be resolved, which directly points to an invalid or unreachable Galaxy server URL.

Answer

The format of the version constraint is invalid.

Answer

The source URL does not include the required endpoint like '/api/v3/'.

Answer

The second collection is not authorized for download.

Question 2

Based on the exhibit, what is the purpose of the `galaxy` dependency entry?

Accepted Answer

Define which Ansible collections to install in the execution environment.. In the context of Ansible execution environments (EEs), the `galaxy` key within the `dependencies` section of the `execution-environment.yml` file specifies a list of Ansible collections to be installed from Ansible Galaxy or an Automation Hub. This allows the EE to include the necessary content collections required for playbook execution, ensuring all roles and modules are available inside the container.

Answer

Set the base container image.

Answer

Specify Python packages to install via pip.

Answer

Configure environment variables for the container.

Question 3

A security team requires that all automation controller job logs be forwarded to an external SIEM system. Which integration should be used?

Accepted Answer

Automation controller's built-in logging aggregator. Automation controller (formerly Ansible Tower) includes a built-in logging aggregator that can forward job logs to external SIEM systems via supported protocols such as HTTPS, TCP, or UDP. This integration is configured directly in the controller's settings, requiring no additional scripts or system-level changes, making it the correct and supported method for centralized log forwarding.

Answer

Ansible Log Forwarder

Answer

Custom callback plugin

Answer

rsyslog configuration

Question 4

An Ansible automation team is designing a playbook to manage network devices. They need to ensure that the playbook can handle transient network failures by retrying failed tasks a specific number of times with a delay between retries. Which approach should they use?

Accepted Answer

Use the `until` loop with `retries` and `delay` parameters on the task.. The `until` loop with `retries` and `delay` parameters is the correct approach because it allows a task to be retried a specified number of times with a configurable pause between attempts, directly addressing transient network failures. This is a built-in Ansible feature for handling intermittent issues without additional error-handling constructs.

Answer

Set `max_fail_percentage` in the play to 0 and use `ignore_errors: yes` with a rescue block.

Answer

Use the `throttle` keyword to limit concurrent tasks and rely on idempotency.

Answer

Set `serial: 1` on the play to ensure only one host is processed at a time and rely on idempotency.

Question 5

The debug output shows 'changed' even when the firewall rule already existed. Which filter issue could cause this?

Accepted Answer

The task should use 'immediate: yes' to reload the firewall, otherwise the module always reports changed.. C is correct because the `firewalld` module in Ansible, by default, operates in 'offline' mode (immediate: no), meaning it only modifies the permanent configuration without applying changes to the running runtime firewall. Even if a rule already exists in the permanent configuration, the module will report 'changed' because it still attempts to add the rule to the runtime zone unless `immediate: yes` is explicitly set to reload the firewall and synchronize the runtime state. This behavior is specific to how `firewalld` separates permanent and runtime rule sets.

Answer

The 'changed' key is misspelled as 'change' in the filter.

Answer

The variable 'fw_result' is undefined because the task failed.

Answer

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Question 6

A team has developed several roles that share common variables. They want to organize these variables in a central file. Where should they place this file so it is automatically loaded by all roles?

Accepted Answer

In the playbook directory as group_vars/all.yml. Placing a file in the playbook directory as group_vars/all.yml makes it automatically loaded by all roles. Ansible automatically includes any YAML files in the group_vars directory that match group names, and the special group 'all' applies to every host. This centralizes shared variables without requiring explicit imports in each role.

Answer

In the inventory directory as host_vars/localhost.yml

Answer

In a common role's vars/main.yml

Answer

In a common role's defaults/main.yml

Question 7

A junior admin created a custom credential type for a third-party API. When running a job that uses this credential, the job fails with 'type object 'Credentials' has no attribute' error. What is the most likely issue?

Accepted Answer

The 'inputs' section in the credential type definition has a misconfigured field name. The error 'type object 'Credentials' has no attribute' typically occurs when the credential type definition's 'inputs' section references a field name that does not match the actual attribute expected by the credential plugin or injector. In Ansible Tower/AWX, the 'inputs' section defines the fields a user fills in (e.g., username, password), and if a field name is misspelled or mismatched with what the credential plugin expects, the plugin cannot find the attribute, causing this error. Option A is correct because a misconfigured field name in 'inputs' directly leads to this attribute lookup failure.

Answer

The 'injectors' section in the credential type definition is missing

Answer

The credential is not assigned to the job template

Answer

The job template is missing the required extra variables

Question 8

An organization uses a private Git repository to store Ansible content collections. They want to automate the building of execution environments that include these collections. Which approach is recommended?

Accepted Answer

Build the collection manually, publish it to a private Automation Hub, then reference it in the EE.. The recommended workflow for including private collections in an execution environment is to build the collection, publish it to a private Automation Hub, and then reference it in the `execution-environment.yml` file. This ensures the collection is available as a signed, versioned artifact that `ansible-builder` can pull during the build process, maintaining integrity and reproducibility without exposing Git credentials or requiring network access during build.

Answer

Store the collection tarball in a Git LFS and use an ADD command in the base image.

Answer

Add the Git repository as a source in the execution-environment.yml using the 'git' type.

Answer

Use ansible-builder to clone the repository during build with a pre-build script.

Question 9

A user wants to authenticate against Ansible Automation Controller using LDAP. They configure the LDAP settings in the controller UI. After saving, they test the connection and it succeeds. However, when an LDAP user tries to log in, they get an authentication failure. What is the most likely issue?

Accepted Answer

The user has not been mapped to an organization within the LDAP configuration.. In Ansible Automation Controller, LDAP users must be explicitly mapped to an organization within the LDAP configuration. Without this mapping, the user is authenticated by the LDAP server but the controller has no authorization context (e.g., organization membership) to allow login. Option B correctly identifies this missing organization mapping as the most likely cause.

Answer

The user is not a member of the required LDAP group that is mapped to a team.

Answer

The controller is case-sensitive and the user entered username in wrong case.

Answer

The LDAP server is configured to use TLS, but the controller uses SAML.

Question 10

An Ansible playbook needs to dynamically include a set of variables based on the environment (dev/staging/prod). The developer wants to use a variable from a lookup plugin that returns a YAML file path. Which lookup plugin is most appropriate for fetching a file’s contents?

Accepted Answer

file. The `file` lookup plugin is the most appropriate for fetching the contents of a file from the control node, as it reads the entire file and returns its content as a string. This is ideal for dynamically including variable files based on environment (e.g., `{{ lookup('file', 'vars/{{ env }}.yml') }}`), allowing the playbook to load environment-specific YAML data.

Answer

env

Answer

pipe

Answer

template