EX294 Implement advanced Ansible automation Practice Test 2 — 15 Questions

Question 1

A systems administrator needs to run a playbook that applies configuration changes to a set of servers. They want to ensure that if any task fails on a host, the playbook continues with the next host without aborting the entire play. Which play-level keyword should they use?

Accepted Answer

`ignore_errors: yes` on each task that might fail.. Option D is correct because `ignore_errors: yes` on each task ensures that if a task fails on a host, the playbook continues executing subsequent tasks on that host and moves on to the next host without aborting the entire play. This directly meets the requirement to continue with the next host upon task failure.

Answer

Set `gather_facts: no` to skip fact gathering and reduce failure points.

Answer

Set `any_errors_fatal: true` at the play level.

Answer

Set `force_handlers: true` at the play level.

Question 2

An Ansible automation engineer is developing a role that manages a microservice. The role needs to include conditional tasks based on whether a variable `microservice_version` is defined. If defined, it should use that version; otherwise, it should default to `latest`. Which of the following is the most efficient and idiomatic way to implement this default value within the role?

Accepted Answer

In the task: `image: "myimage:{{ microservice_version | default('latest') }}"`. Option D is correct because it uses the `default` filter directly in the task to set a fallback value for `microservice_version` when it is undefined. This is the most efficient and idiomatic approach in Ansible, as it avoids modifying role defaults or introducing extra variables, and it handles the conditional logic inline without unnecessary complexity.

Answer

In `defaults/main.yml`: `microservice_version: latest` and reference `{{ microservice_version }}` in the task.

Answer

In the task: `image: "myimage:{{ microservice_version }}"` and use `| mandatory` to fail if undefined.

Answer

In the task: `vars: microservice_version: "{{ microservice_version | default('latest') }}"`

Question 3

Which TWO statements about Ansible roles are correct? (Select exactly 2)

Accepted Answer

Roles can have dependencies on other roles defined in `meta/main.yml`.. Option B is correct because Ansible roles can declare dependencies on other roles in their `meta/main.yml` file using the `dependencies` keyword. This ensures that dependent roles are executed before the dependent role, enabling modular and reusable automation workflows.

Answer

A role can directly include tasks from another role using the `include_tasks` module.

Answer

Variables defined in `defaults/main.yml` override those in `vars/main.yml`.

Answer

Roles cannot include playbooks.

Question 4

Your team is responsible for managing a fleet of 200 RHEL 8 servers using Ansible Tower. You have been asked to implement a secure automation workflow that meets the following requirements:

1. All playbooks must be stored in a private Git repository hosted on an internal GitLab server.
2. Credentials to access the Git repository must be stored securely in Ansible Tower.
3. The automation must run on a schedule every night at 2:00 AM.
4. If a playbook run fails, the team must be notified via email.
5. The playbooks require SSH private keys to connect to the managed hosts; these keys must be stored securely.
6. A development team needs to be able to launch the same job template manually, but they must not be able to modify the job template or view the credentials.

You have created a Machine Credential for SSH and a Source Control Credential for Git. You have also created a Job Template that references the project, inventory, and credentials. What is the correct sequence of steps to satisfy all requirements?

Accepted Answer

1. Create a Project in Tower, pointing to the Git repository and associate the Source Control Credential. 2. Create a Job Template referencing the Project, and add the Machine Credential. 3. Assign the development team read and execute permissions on the Job Template (not admin). 4. Create a Schedule for the Job Template to run at 2:00 AM. 5. Configure a Notification Template for email on failure and associate it with the Job Template.. Option D is correct because it correctly sequences the steps: first creating a Project with the Source Control Credential to securely access the private Git repository, then creating a Job Template that references the Project and includes the Machine Credential for SSH access to managed hosts. Assigning the development team 'read and execute' permissions (not admin) satisfies the requirement that they can launch the job template manually but cannot modify it or view credentials. Creating a Schedule for 2:00 AM and configuring a Notification Template for email on failure completes the automation workflow.

Answer

1. Create a Project in Tower, pointing to the Git repository and associate the Source Control Credential. 2. Create a Job Template referencing the Project. 3. Add the Machine Credential to the Job Template. 4. Create a Schedule for the Job Template. 5. Assign the development team execute-only permissions on the Job Template. 6. Configure a Notification Template for email on failure.

Answer

1. Create a Schedule for 2:00 AM. 2. Create a Project in Tower with Source Control Credential. 3. Create a Job Template with Machine Credential. 4. Assign the development team admin permissions on the Job Template. 5. Configure a Notification Template.

Answer

1. Create a Project in Tower, pointing to the Git repository without a credential. 2. Create a Job Template referencing the Project. 3. Add the Source Control Credential to the Job Template. 4. Create a Schedule for the Job Template. 5. Assign the development team read-only permissions on the Job Template. 6. Configure a Notification Template for email on failure.

Question 5

An engineer runs the playbook as shown. What is the expected result?

Accepted Answer

The 'configure firewall' task is executed, the 'enable service' task is skipped, and the playbook continues to the next play.. Option B is correct because the playbook uses the `block` and `rescue` keywords. The 'configure firewall' task runs first and fails (e.g., due to a syntax error or connectivity issue). The `rescue` block then executes the 'enable service' task. However, the `always` block (which contains 'start service') is not present, so the playbook does not execute any 'always' tasks; instead, it proceeds to the next play after the rescue block completes. The 'start service' task is not part of the block/rescue structure and is skipped because the play moves to the next play after the rescue.

Answer

Only the 'configure firewall' task is executed; the rest are skipped.

Answer

All tasks are executed and the playbook completes successfully.

Answer

The 'configure firewall' and 'enable service' tasks are executed; the 'start service' task is skipped.

Question 6

An Ansible Automation Platform administrator is reviewing a job template that runs a playbook against a large inventory. To improve performance without sacrificing accuracy, which TWO strategies should be implemented? (Choose two.)

Accepted Answer

Implement the ansible-cmdb tool to generate a CMDB from gathered facts.. Option A is correct because the ansible-cmdb tool generates a Configuration Management Database (CMDB) from gathered facts, which can be used for documentation and analysis without re-running fact gathering on every playbook execution. Option B is correct because enabling fact caching with a Redis backend stores gathered facts in a fast, external cache, allowing subsequent playbook runs to reuse cached facts instead of gathering them again from each host, which significantly reduces execution time for large inventories.

Answer

Use the serial keyword to limit concurrent execution to 1 host at a time.

Answer

Set forks to 50 in ansible.cfg to maximize parallel execution.

Answer

Set gathering = explicit in ansible.cfg to skip fact gathering.

Question 7

A large enterprise manages its infrastructure with Ansible Automation Platform. The operations team reports that job runs are taking longer than expected, especially for playbooks that include role dependencies. After investigation, they notice that the control node has high CPU and memory usage during job execution. The inventory contains 500 hosts, and the playbooks use several roles that include dynamic includes (include_tasks) based on conditional variables. The team wants to reduce the load on the control node without changing the playbook logic or reducing functionality. Which action should the team take?

Accepted Answer

Enable pipelining in ansible.cfg by setting pipelining = True.. Enabling pipelining reduces the number of SSH connections Ansible makes to each host by combining multiple task operations into a single SSH session. This drastically lowers the overhead on the control node's CPU and memory, especially when executing many tasks with dynamic includes across a large inventory, without altering playbook logic.

Answer

Use the --limit flag to run the playbook against a subset of hosts.

Answer

Increase the forks value in ansible.cfg to 100 to speed up execution.

Answer

Migrate to AWX to distribute job execution across multiple nodes.

Question 8

Drag and drop the steps to configure a network bond (bond0) using nmcli in the correct order.

Question 9

Match each Ansible fact variable to its description.

Question 10

A team wants to ensure that a sensitive variable, such as a database password, is not printed when ansible-playbook runs with -v (verbose). What is the best method to achieve this?

Accepted Answer

Use the 'no_log: true' directive on the task.. Option A is correct because 'no_log: true' prevents the task's input and output from being logged. Option B is good practice but does not prevent logging if the task prints the variable. Option C is insecure as environment variables may be exposed. Option D encrypts the variable but if the task prints it, it's still logged. Therefore, A is the best direct method.

Answer

Set the password as an environment variable on the control node.

Answer

Store the password in a file with 0600 permissions and use lookup('file', ...).

Answer

Use the 'ansible-vault encrypt_string' command and reference the variable from a vault file.

Question 11

An Ansible playbook runs tasks on a group of web servers. During a rolling update, the playbook should ensure that no more than 2 servers are taken out of service at the same time. Which play keyword should be used?

Accepted Answer

serial: 2. Option A is correct because 'serial: 2' processes hosts in batches of 2, limiting concurrency. Option B controls total forks but not batching. Option C sets a failure threshold. Option D throttles task concurrency but not host batching. Therefore, A is correct.

Answer

forks: 2

Answer

max_fail_percentage: 2

Answer

throttle: 2

Question 12

A playbook uses the 'include_tasks' module to load platform-specific tasks. The playbook fails intermittently with 'Could not find or access file' error on some runs but works on others. Which of the following is the most likely cause?

Accepted Answer

The 'include_tasks' is used with a loop and the loop variable shadows the included file's parameter.. Option D is correct because if the loop variable used in include_tasks shadows a parameter expected by the included file, it can cause variable collision and file resolution issues. Option A is less likely because Ansible's search order is consistent. Option B and C would cause consistent failures. Therefore, D is the most likely cause.

Answer

The 'include_tasks' is used inside a block that has 'always' section.

Answer

The task file path is not absolute and Ansible's search order is inconsistent.

Answer

The playbook uses 'any_errors_fatal: true' causing early exits.

Question 13

An administrator wants to reuse a set of tasks across multiple playbooks. Which Ansible approach is most appropriate?

Accepted Answer

Creating a role with tasks in tasks/main.yml.. Option B is correct because roles are the standard mechanism for reusable content. Option A is overkill for simple task reuse. Option C is for documentation, not reuse. Option D is for encryption, not reuse. Therefore, B is correct.

Answer

Encrypting the tasks with Ansible Vault.

Answer

Using ansible-doc to document the tasks.

Answer

Writing a custom module in Python.

Question 14

A playbook uses 'vars_prompt' to ask for a confirmation before proceeding with destructive changes. However, when the playbook is run from a CI/CD pipeline, it hangs indefinitely. What is the best way to handle this?

Accepted Answer

Pass the variable via --extra-vars and modify the prompt to be conditional with 'when: variable is not defined'.. Option E is correct because passing the variable via --extra-vars and making the prompt conditional with 'when: variable is not defined' allows the pipeline to provide the variable non-interactively. Option A is unsafe. Option B's --check mode does not solve prompts. Option C is unrelated. Option D encrypts data but does not handle prompts. Therefore, E is best.

Answer

Remove the prompt and always proceed.

Answer

Set ANSIBLE_STDOUT_CALLBACK=unixy to avoid interactive prompts.

Answer

Encrypt the confirmation in vault and include it.

Answer

Use --check mode to simulate.

Question 15

A playbook uses the 'block' feature to group tasks and includes a 'rescue' section. If a task inside the block fails, what happens?

Accepted Answer

The rescue tasks run, and the play continues with the next task after the block.. Option A is correct. The rescue tasks run after a failure inside the block, and then the play continues with the next task after the block. Option B is wrong because the play does not fail after rescue. Option C is wrong because the block is not re-executed. Option D is wrong because rescue tasks are executed. Therefore, A is correct.

Answer

The rescue tasks run, and then the entire playbook fails.

Answer

The rescue tasks are ignored and the play fails immediately.

Answer

The block is re-executed after rescue.