EX294 Implement advanced Ansible automation — All Questions With Answers

Question 1

An Ansible playbook fails intermittently when deploying web servers. The error message indicates that a required package is not available in the repository. Which approach would best ensure that the required packages are consistently available before the playbook runs?

Accepted Answer

Add a pre_task to run 'dnf update' or 'apt update' before the package installation.. The intermittent failure is caused by the package metadata cache being stale or missing. Running 'dnf update' (RHEL/CentOS) or 'apt update' (Debian/Ubuntu) as a pre_task refreshes the repository index, ensuring that the package manager has the latest list of available packages before attempting installation. This directly resolves the 'package not available' error by synchronizing the local cache with the remote repository.

Answer

Set 'ignore_errors: yes' on the package installation task and handle the failure later.

Answer

Add retries and delay to the package installation task.

Answer

Use the 'get_url' module to download the package from an external source and install it manually.

Question 2

A system administrator wants to run a playbook on all hosts in the 'webservers' group, but only if the host is currently online. Which approach should be used?

Accepted Answer

Use 'wait_for_connection' as a pre-task to ensure connectivity.. The `wait_for_connection` module is specifically designed to pause the playbook execution until a remote host becomes reachable over SSH or WinRM. By placing it as a pre-task, the playbook will only proceed to subsequent tasks for hosts that are currently online, effectively filtering out offline hosts. This directly meets the requirement to run the playbook only on hosts in the 'webservers' group that are online.

Answer

Set 'gather_facts: no' to skip fact collection.

Answer

Use 'throttle: 1' to limit concurrent connections.

Answer

Set 'serial: 1' to run on one host at a time.

Question 3

You have an Ansible playbook that uses the 'lineinfile' module to manage the /etc/ssh/sshd_config file. The playbook runs without errors, but after execution, the SSH service becomes unreachable on some hosts. Investigation reveals that the file contains duplicate lines for 'Port 22' and 'PermitRootLogin no'. The playbook uses the following task:

- name: Ensure SSH settings
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^{{ item.key }}"
    line: "{{ item.key }} {{ item.value }}"
  loop:
    - { key: 'Port', value: '22' }
    - { key: 'PermitRootLogin', value: 'no' }

The playbook is run multiple times. What is the most likely cause of the duplicate lines?

Accepted Answer

The regexp pattern does not match the existing lines exactly, causing new lines to be added instead of replacing.. The regexp pattern `^{{ item.key }}` matches only the start of a line (e.g., `^Port` or `^PermitRootLogin`), but the existing lines in `/etc/ssh/sshd_config` may have leading spaces or tabs (common in SSH config files). Since the regex does not match the actual line due to whitespace, the `lineinfile` module inserts a new line instead of replacing the existing one. Each playbook run adds another duplicate, eventually causing SSH to fail due to conflicting directives.

Answer

The 'lineinfile' module is not idempotent when used with loops.

Answer

The loop should use 'with_items' instead of 'loop' for proper idempotence.

Answer

The 'line' parameter should use backreferences to avoid duplication.

Question 4

A systems administrator needs to run a playbook that applies configuration changes to a set of servers. They want to ensure that if any task fails on a host, the playbook continues with the next host without aborting the entire play. Which play-level keyword should they use?

Accepted Answer

`ignore_errors: yes` on each task that might fail.. `ignore_errors: yes` on each task ensures that if a task fails on a host, the playbook continues executing subsequent tasks on that host and moves on to the next host without aborting the entire play. This directly meets the requirement to continue with the next host upon task failure.

Answer

Set `gather_facts: no` to skip fact gathering and reduce failure points.

Answer

Set `any_errors_fatal: true` at the play level.

Answer

Set `force_handlers: true` at the play level.

Question 5

An Ansible automation engineer is developing a role that manages a microservice. The role needs to include conditional tasks based on whether a variable `microservice_version` is defined. If defined, it should use that version; otherwise, it should default to `latest`. Which of the following is the most efficient and idiomatic way to implement this default value within the role?

Accepted Answer

In the task: `image: "myimage:{{ microservice_version | default('latest') }}"`. It uses the `default` filter directly in the task to set a fallback value for `microservice_version` when it is undefined. This is the most efficient and idiomatic approach in Ansible, as it avoids modifying role defaults or introducing extra variables, and it handles the conditional logic inline without unnecessary complexity.

Answer

In `defaults/main.yml`: `microservice_version: latest` and reference `{{ microservice_version }}` in the task.

Answer

In the task: `image: "myimage:{{ microservice_version }}"` and use `| mandatory` to fail if undefined.

Answer

In the task: `vars: microservice_version: "{{ microservice_version | default('latest') }}"`

Question 6

Which THREE statements about Ansible roles are correct? (Select exactly 3)

Accepted Answer

Roles can have dependencies on other roles defined in `meta/main.yml`.. Option B is correct because Ansible roles declare inter-role dependencies in meta/main.yml using the dependencies: key, and those dependent roles are executed before the current role by default. Option C is correct because Ansible defines a standard role skeleton with directories such as tasks/, handlers/, defaults/, vars/, meta/, templates/, and files/, each holding content that Ansible loads automatically from well-known filenames like main.yml. Option E is correct because roles are units of tasks, handlers, variables, and files, not playbooks; a role cannot contain or include a playbook, though playbooks can reference roles via the roles: keyword or import_role/include_role. Option A is not correct because include_tasks includes a task list file, not another role; to pull in another role's tasks you use include_role or import_role. Option D is not correct because defaults/main.yml has the lowest precedence, so vars/main.yml overrides defaults, not the other way around.

Answer

A role can directly include tasks from another role using the `include_tasks` module.

Answer

Variables defined in `defaults/main.yml` override those in `vars/main.yml`.

Question 7

Your team is responsible for managing a fleet of 200 RHEL 8 servers using Ansible Tower. You have been asked to implement a secure automation workflow that meets the following requirements:

1. All playbooks must be stored in a private Git repository hosted on an internal GitLab server.
2. Credentials to access the Git repository must be stored securely in Ansible Tower.
3. The automation must run on a schedule every night at 2:00 AM.
4. If a playbook run fails, the team must be notified via email.
5. The playbooks require SSH private keys to connect to the managed hosts; these keys must be stored securely.
6. A development team needs to be able to launch the same job template manually, but they must not be able to modify the job template or view the credentials.

You have created a Machine Credential for SSH and a Source Control Credential for Git. You have also created a Job Template that references the project, inventory, and credentials. What is the correct sequence of steps to satisfy all requirements?

Accepted Answer

1. Create a Project in Tower, pointing to the Git repository and associate the Source Control Credential. 2. Create a Job Template referencing the Project, and add the Machine Credential. 3. Assign the development team read and execute permissions on the Job Template (not admin). 4. Create a Schedule for the Job Template to run at 2:00 AM. 5. Configure a Notification Template for email on failure and associate it with the Job Template.. It correctly sequences the steps: first creating a Project with the Source Control Credential to securely access the private Git repository, then creating a Job Template that references the Project and includes the Machine Credential for SSH access to managed hosts. Assigning the development team 'read and execute' permissions (not admin) satisfies the requirement that they can launch the job template manually but cannot modify it or view credentials. Creating a Schedule for 2:00 AM and configuring a Notification Template for email on failure completes the automation workflow.

Answer

1. Create a Project in Tower, pointing to the Git repository and associate the Source Control Credential. 2. Create a Job Template referencing the Project. 3. Add the Machine Credential to the Job Template. 4. Create a Schedule for the Job Template. 5. Assign the development team execute-only permissions on the Job Template. 6. Configure a Notification Template for email on failure.

Answer

1. Create a Schedule for 2:00 AM. 2. Create a Project in Tower with Source Control Credential. 3. Create a Job Template with Machine Credential. 4. Assign the development team admin permissions on the Job Template. 5. Configure a Notification Template.

Answer

1. Create a Project in Tower, pointing to the Git repository without a credential. 2. Create a Job Template referencing the Project. 3. Add the Source Control Credential to the Job Template. 4. Create a Schedule for the Job Template. 5. Assign the development team read-only permissions on the Job Template. 6. Configure a Notification Template for email on failure.

Question 8

An engineer runs the playbook as shown:

```yaml
- hosts: all
  tasks:
    - block:
        - name: configure firewall
          command: /bin/false
    - name: enable service
      service: name=httpd enabled=yes
    - name: start service
      service: name=httpd state=started

- hosts: all
  tasks:
    - name: next task
      debug: msg="Continuing to next play"
```

What is the expected result?

Accepted Answer

The 'configure firewall' task is executed, the 'enable service' task is skipped, and the playbook continues to the next play.. The playbook includes a block containing only the 'configure firewall' task. When this task fails and no rescue block is defined, the play fails immediately. The playbook then moves to the next play, skipping any remaining tasks in the current play, including the 'enable service' task. Thus, 'configure firewall' is executed, 'enable service' is skipped, and the playbook continues to the next play.

Answer

Only the 'configure firewall' task is executed; the rest are skipped.

Answer

All tasks are executed and the playbook completes successfully.

Answer

The 'configure firewall' and 'enable service' tasks are executed; the 'start service' task is skipped.

Question 9

An Ansible Automation Platform administrator is reviewing a job template that runs a playbook against a large inventory. To improve performance without sacrificing accuracy, which TWO strategies should be implemented? (Choose two.)

Accepted Answer

Implement the ansible-cmdb tool to generate a CMDB from gathered facts.. Option B is correct because enabling fact caching with a Redis backend (e.g., fact_caching = redis and fact_caching_connection pointing to the Redis instance) lets subsequent playbook runs reuse previously gathered facts instead of re-collecting them from every host, which speeds up execution against a large inventory while keeping facts accurate and available. Option A is correct because ansible-cmdb consumes the facts Ansible gathers and generates a CMDB report, allowing the administrator to persist and reuse inventory/fact data for reporting and analysis without repeatedly gathering it, supporting performance without losing accuracy. Option C is incorrect because setting serial to 1 deliberately limits execution to one host at a time, which reduces parallelism and slows down the run rather than improving performance. Option D is incorrect because simply raising forks to 50 in ansible.cfg increases parallel task execution but can overwhelm the control node or targets and does not by itself preserve accuracy or optimize fact handling. Option E is incorrect because gathering = explicit skips automatic fact gathering, which can break playbooks that rely on facts and sacrifices accuracy rather than improving performance safely.

Answer

Use the serial keyword to limit concurrent execution to 1 host at a time.

Answer

Set forks to 50 in ansible.cfg to maximize parallel execution.

Answer

Set gathering = explicit in ansible.cfg to skip fact gathering.

Question 10

A large enterprise manages its infrastructure with Ansible Automation Platform. The operations team reports that job runs are taking longer than expected, especially for playbooks that include role dependencies. After investigation, they notice that the control node has high CPU and memory usage during job execution. The inventory contains 500 hosts, and the playbooks use several roles that include dynamic includes (include_tasks) based on conditional variables. The team wants to reduce the load on the control node without changing the playbook logic or reducing functionality. Which action should the team take?

Accepted Answer

Enable pipelining in ansible.cfg by setting pipelining = True.. Enabling pipelining reduces the number of SSH connections Ansible makes to each host by combining multiple task operations into a single SSH session. This drastically lowers the overhead on the control node's CPU and memory, especially when executing many tasks with dynamic includes across a large inventory, without altering playbook logic.

Answer

Use the --limit flag to run the playbook against a subset of hosts.

Answer

Increase the forks value in ansible.cfg to 100 to speed up execution.

Answer

Migrate to AWX to distribute job execution across multiple nodes.

Question 11

A playbook uses the 'include_tasks' module to load platform-specific tasks. The playbook fails intermittently with 'Could not find or access file' error on some runs but works on others. Which of the following is the most likely cause?

Accepted Answer

The 'include_tasks' is used with a loop and the loop variable shadows the included file's parameter.. When 'include_tasks' is used inside a loop, the loop variable (e.g., 'item') can override or shadow the parameters expected by the included task file. This causes the included file to receive unexpected variable values, leading to incorrect file path resolution and intermittent 'Could not find or access file' errors depending on the loop iteration.

Answer

The 'include_tasks' is used inside a block that has 'always' section.

Answer

The task file path is not absolute and Ansible's search order is inconsistent.

Answer

The playbook uses 'any_errors_fatal: true' causing early exits.

Question 12

An Ansible role has multiple dependencies defined in meta/main.yml. One of the dependent roles should be executed before the role's own tasks, but only if a certain condition is met. How can this be implemented?

Accepted Answer

The dependency cannot be conditional; use 'include_role' with 'when' in the tasks.. Ansible role dependencies defined in meta/main.yml do not support conditional execution; the 'dependencies' field only accepts role names or a dictionary with 'role' and optional 'vars'. To conditionally execute a role, you must use 'include_role' with a 'when' clause in the playbook or tasks, not in the metadata. This is by design because dependency resolution happens at playbook parsing time, not at runtime.

Answer

Use 'condition' field in the dependencies list.

Answer

Use 'when' condition in the role's tasks to include the dependency.

Answer

Use 'pre_tasks' in the playbook to run the conditional dependency.

Question 13

A playbook uses 'delegate_to: localhost' for a task that modifies a local file. The playbook runs against multiple servers. The administrator notices that the local file is overwritten by each parallel execution, causing corruption. Which strategy should be used to prevent this?

Accepted Answer

Use 'run_once: true' along with 'delegate_to'.. `run_once: true` ensures that the task executes only once across the entire batch of hosts, even when `delegate_to: localhost` is used. This prevents the local file from being overwritten by multiple parallel executions, as the task runs on a single host (the first in the inventory) and delegates the file modification to localhost once.

Answer

Increase 'forks: 1' to serialize execution.

Answer

Use 'throttle: 1' on the task.

Answer

Use 'serial: 1' at the play level.

Question 14

An Ansible playbook uses 'async' and 'poll' to run a long-running task. The task returns a changed status and the playbook continues. However, the remote server reports that the task failed after the playbook finished. What is the most likely reason?

Accepted Answer

The task's return code was not checked; 'async_status' module should be used to explicitly check the job result.. When a task is launched with `async` and `poll: 0`, Ansible does not wait for the task to complete; it immediately continues the playbook. The task runs in the background on the remote host, and its final result (including failure) is not automatically captured by the playbook. To retrieve the actual exit status and output, you must explicitly use the `async_status` module with the job ID to poll the task until it finishes. Without this explicit check, the playbook may report success even if the background task ultimately fails.

Answer

The 'async' timeout was set too high.

Answer

The 'poll' interval was set too low.

Answer

The playbook used 'ignore_errors: true' on the async task.

Question 15

An administrator wants to ensure that Ansible facts gathered from a host are consistent across multiple playbook runs. Which two actions can help achieve this? (Choose two.)

Accepted Answer

Enable fact caching using 'ansible_cache' plugin with a persistent backend like Redis.. Enabling fact caching with a persistent backend like Redis stores gathered facts between playbook runs, ensuring consistency without re-gathering. Option E is correct because setting 'ANSIBLE_GATHERING=smart' with a configured cache_timeout allows Ansible to reuse cached facts within the timeout period, providing consistent data across runs.

Answer

Use 'gather_facts: no' and manually run 'setup' module with specific filter.

Answer

Use 'tags' to only gather facts on selective runs.

Answer

Disable fact caching and gather facts every time.

Question 16

An Ansible playbook repeatedly uses the same pattern: check if a service is running, if not start it, and then verify it's running. Which three Ansible features can be used to reduce code duplication? (Choose three.)

Accepted Answer

Using a role with multiple tasks and handlers.. Option B is correct because a role packages reusable tasks, handlers, and defaults into a single unit, so the repeated check-start-verify sequence can be defined once and invoked from multiple plays, with handlers cleanly managing service restarts or state changes. Option E is correct because 'include_tasks' dynamically includes a common task file at runtime, and pairing it with a loop (e.g., 'loop' over service names) lets the same check-start-verify task file be reused for many services without duplicating YAML. Option A is not correct because 'include_vars' only loads external variable files into a play; it does not encapsulate or reuse task logic, so it cannot reduce duplication of the check-start-verify task sequence. Option C is not correct because the 'debug' module merely prints messages or variable values for troubleshooting and performs no service management or logic encapsulation. Option D is not correct because custom filter plugins transform data inside Jinja2 expressions; they cannot contain the multi-step task logic (service checks, starts, and verification) that this scenario requires.

Answer

Using 'include_vars' to reuse variable files.

Answer

Using 'debug' module to output the status.

Answer

Creating a custom filter plugin to encapsulate the logic.

Question 17

Refer to the exhibit. Which of the following is the most likely cause of this error?

Accepted Answer

The 'ask_become_pass' is set to 'false' and no become password is provided.. The error message indicates that Ansible is unable to authenticate with the remote host, which occurs when `ask_become_pass` is set to `false` (or defaults to `false` in some configurations) and no become password is provided via `--ask-become-pass` or an `ansible_become_password` variable. Without a password, the privilege escalation attempt fails, resulting in a permission denied error.

Answer

The playbook is running without '--become' flag.

Answer

The 'become_method' is set to 'su' instead of 'sudo'.

Answer

The 'ansible_become_password' was provided but incorrect.

Answer

The remote user is not in the sudoers file.

Question 18

Refer to the exhibit. A playbook targeting the 'webservers' group uses '{{ http_port }}'. What will be the value of 'http_port' on 'web2'?

Accepted Answer

8080. In Ansible, host variables take precedence over group variables. The inventory defines 'web2' with 'http_port: 8080' as a host variable, while the 'webservers' group defines 'http_port: 80' as a group variable. Since host variables override group variables, the value of 'http_port' on 'web2' is 8080.

Answer

80

Answer

80, because the group variable overrides host variable.

Answer

Undefined, causing an error

Question 19

An Ansible playbook uses the 'constructed' inventory plugin with 'keyed_groups' to create groups based on 'ansible_distribution'. Despite correct configuration, hosts are not assigned to the expected groups. What is the most likely cause?

Accepted Answer

the 'strict' option is set to 'yes' and the required facts are not gathered. 'strict: yes' causes plugin to fail on undefined variables; if facts are not gathered, 'ansible_distribution' is undefined. Options A, B, D are plausible but less likely.

Answer

the 'keyed_groups' syntax uses invalid Jinja2 expressions

Answer

the inventory file is incorrectly formatted

Answer

the plugin is not enabled in ansible.cfg

Question 20

An Ansible playbook uses a 'block' to group multiple tasks and includes a 'rescue' section. If a task inside the block fails, what will happen?

Accepted Answer

the rescue section runs, and the playbook continues with tasks after the block. When a task inside a block fails, Ansible executes the rescue section, and after rescue completes, the playbook continues with tasks after the block (C). The rescue block is designed to handle errors gracefully and allow the play to proceed, rather than aborting the entire run. This is the core semantics of block/rescue/always in Ansible.

Answer

the rescue section runs and then the playbook resumes with the next task after the block

Answer

the block is re-executed from the beginning

Answer

the playbook stops immediately

EX294 Implement advanced Ansible automation — All Questions With Answers

An Ansible playbook fails intermittently when deploying web servers. The error message indicates that a required package is not available in the repository. Which approach would best ensure that the required packages are consistently available before the playbook runs?

A system administrator wants to run a playbook on all hosts in the 'webservers' group, but only if the host is currently online. Which approach should be used?

A systems administrator needs to run a playbook that applies configuration changes to a set of servers. They want to ensure that if any task fails on a host, the playbook continues with the next host without aborting the entire play. Which play-level keyword should they use?

Which THREE statements about Ansible roles are correct? (Select exactly 3)

An Ansible Automation Platform administrator is reviewing a job template that runs a playbook against a large inventory. To improve performance without sacrificing accuracy, which TWO strategies should be implemented? (Choose two.)

A playbook uses the 'include_tasks' module to load platform-specific tasks. The playbook fails intermittently with 'Could not find or access file' error on some runs but works on others. Which of the following is the most likely cause?

An Ansible role has multiple dependencies defined in meta/main.yml. One of the dependent roles should be executed before the role's own tasks, but only if a certain condition is met. How can this be implemented?

A playbook uses 'delegate_to: localhost' for a task that modifies a local file. The playbook runs against multiple servers. The administrator notices that the local file is overwritten by each parallel execution, causing corruption. Which strategy should be used to prevent this?

An Ansible playbook uses 'async' and 'poll' to run a long-running task. The task returns a changed status and the playbook continues. However, the remote server reports that the task failed after the playbook finished. What is the most likely reason?

An administrator wants to ensure that Ansible facts gathered from a host are consistent across multiple playbook runs. Which two actions can help achieve this? (Choose two.)

An Ansible playbook repeatedly uses the same pattern: check if a service is running, if not start it, and then verify it's running. Which three Ansible features can be used to reduce code duplication? (Choose three.)

Refer to the exhibit. Which of the following is the most likely cause of this error?

Exhibit

Refer to the exhibit. A playbook targeting the 'webservers' group uses '{{ http_port }}'. What will be the value of 'http_port' on 'web2'?

Exhibit

An Ansible playbook uses the 'constructed' inventory plugin with 'keyed_groups' to create groups based on 'ansible_distribution'. Despite correct configuration, hosts are not assigned to the expected groups. What is the most likely cause?

An Ansible playbook uses a 'block' to group multiple tasks and includes a 'rescue' section. If a task inside the block fails, what will happen?

An Ansible playbook sets a variable with a dictionary value in the play's vars and also in group_vars/all. When the play runs, the dictionary in group_vars completely replaces the one in play vars. What is the most likely reason?

An Ansible playbook uses delegation to run a task on localhost while targeting remote hosts. The task fails with 'connection refused' for the remote host. What is the most likely cause?

Which TWO of the following are valid methods to include external variable files into an Ansible playbook?

Refer to the exhibit. The playbook fails with this error. What is the most likely cause?

Exhibit

Refer to the exhibit. An Ansible playbook targeting 'production' hosts fails with 'deploy_user is undefined'. What is the most likely cause?

Exhibit

An Ansible playbook uses the lineinfile module to ensure a specific line is present in a configuration file. However, after running the playbook multiple times, the line is duplicated each time. Which option best explains this behavior?

An Ansible role has tasks that need to run in a specific order, and some tasks must use a different shell interpreter. Which feature allows the role to control task execution order and environment settings?

A playbook uses the 'win_chocolatey' module to install software on Windows hosts. The playbook is idempotent for most packages, but one package consistently fails with 'The package is already installed' error despite being reinstalled each run. Which approach ensures true idempotency?

Which TWO statements about Ansible roles are correct?

Which TWO conditions are necessary for the 'local_action' directive to work as intended?

Which THREE factors are essential for achieving idempotent behavior in Ansible plays?

Given the inventory above, which user will Ansible use when connecting to 'web2'?

Exhibit

The playbook above fails with 'template source file not found' for the copy task. Which change should be made to fix it?

Exhibit

Given the command and error above, what is the most likely cause of the failure?

An administrator needs to apply a set of firewall rules to multiple servers. They have created a playbook that uses the firewalld module. When running the playbook, they receive 'ERROR! module not found: firewalld'. The control node has the module available locally. What is the most likely cause?

A playbook must execute cleanup tasks after a block of tasks, both on success and failure. Which two of the following should be used within the block to achieve this?

An Ansible inventory file includes a group [webservers] containing web1. Another group [all] contains web1 and web2. When running a playbook with --limit webservers, the playbook fails on web2. Why does this happen?

Refer to the exhibit. A playbook fails with the error 'file not found: /var/www/app-v2.1.0.tar.gz' on the control node. What is the most likely cause?

Exhibit

Refer to the exhibit. The playbook fails to install httpd on server1. Which is the most likely cause?

Exhibit

Refer to the exhibit. An admin wants to run a playbook on all hosts in the 'webservers' group. Which ansible-playbook command is correct?

Refer to the exhibit. After running the playbook, the admin checks /etc/ssh/sshd_config and finds that the MaxAuthTries line is unchanged. What is the most likely cause?

Exhibit

Refer to the exhibit. The playbook runs successfully, but the service is not restarted. What is the most likely cause?

Exhibit

A playbook needs to include a task file conditionally based on a variable `install_web`. The task file is named `web.yml`. Which directive should be used to include it only when `install_web` is true?

A playbook needs to run a task only on hosts that are members of the 'dbservers' group. Which conditional should be used to achieve this?

A playbook targeting a group of application servers must apply a set of tasks only when the variable 'app_env' is set to 'production'. The variable is defined in group_vars. Which conditional should be used on the tasks to ensure they run only in production?

An engineer writes a task that uses the `include_role` module with a loop to apply multiple roles conditionally. The play fails with an error about loop and include_role. Which change resolves the issue?

A playbook uses a role that has a dependency declared in meta/main.yml. The dependency role is expected to run before the main role. However, during execution, the dependency role's tasks are skipped. What is the most likely reason?

A playbook should run a task only on hosts that are members of the `db` group and have the `ansible_facts['os_family']` equal to `RedHat`. Which conditional achieves this?

An administrator is designing a playbook that uses roles. They want to ensure that certain variables defined in the role's `vars/main.yml` can be overridden by inventory variables. Which two statements about Ansible variable precedence are correct? (Choose two.)

An automation engineer is writing a playbook that must run a task only on hosts that are members of both the `web` and `db` groups in the inventory. The inventory defines these groups with overlapping hosts. Which conditional expression should be used in the task's `when` clause to achieve this?

An administrator needs to ensure that a task only runs when a variable named `mode` is defined and equals `production`. Which two conditions correctly achieve this? (Choose two.)

An engineer is designing a playbook that must use a custom Ansible module stored in a local directory `library/` within the project. The playbook will be run from different working directories. Which two actions ensure the custom module is found and executed correctly? (Choose two.)

A playbook must copy a file to a remote host only if the file does not already exist on that host. The file content varies per host and is generated by a template on the control node. Which task design achieves this most efficiently?

An administrator wants to reuse a set of tasks that configure a firewall across multiple playbooks. Which Ansible feature should be used to achieve this?

A playbook uses the 'include_tasks' module to dynamically include tasks based on a variable. The playbook runs successfully on some hosts but fails on others with a 'template error' message. What is the most likely cause?

An Ansible playbook is designed to run on a group of database servers. The administrator wants to ensure that a task runs only on the primary database server, which is defined in the inventory with a variable 'primary: true'. Which conditional should be used?

A playbook uses the 'block' and 'rescue' keywords to handle errors. The block contains three tasks. The first task fails. What happens next?

An administrator needs to securely pass a database password to a playbook without exposing it in logs or the command line. Which approach is the most secure?

An Ansible playbook includes a role that defines default variables in 'defaults/main.yml' and role variables in 'vars/main.yml'. A playbook sets the same variable in the play's 'vars' section. Which variable value takes precedence?

Which TWO statements about Ansible collections are correct?

Which THREE of the following are valid uses of the 'ansible.builtin.include_role' module?

Which TWO of the following are advantages of using 'ansible-pull' over 'ansible-playbook'?

An Ansible automation team is designing a playbook to manage network devices. They need to ensure that the playbook can handle transient network failures by retrying failed tasks a specific number of times with a delay between retries. Which approach should they use?

Drag and drop the steps to configure a network bond (bond0) using nmcli in the correct order.

Match each Ansible fact variable to its description.

A team wants to ensure that a sensitive variable, such as a database password, is not printed when ansible-playbook runs with -v (verbose). What is the best method to achieve this?

An Ansible playbook runs tasks on a group of web servers. During a rolling update, the playbook should ensure that no more than 2 servers are taken out of service at the same time. Which play keyword should be used?

An administrator wants to reuse a set of tasks across multiple playbooks. Which Ansible approach is most appropriate?

A playbook uses 'vars_prompt' to ask for a confirmation before proceeding with destructive changes. However, when the playbook is run from a CI/CD pipeline, it hangs indefinitely. What is the best way to handle this?

A playbook uses the 'block' feature to group tasks and includes a 'rescue' section. If a task inside the block fails, what happens?

Which three of the following are valid methods to pass variables to an Ansible playbook at runtime? (Choose three.)

Refer to the exhibit. What is the purpose of the 'failed_when' condition?

Exhibit

A developer reports that a role's behavior is not as expected. They set a variable in the playbook's vars section, but the role still uses the value from its vars/main.yml. Which of the following explains this issue?