EX294 Implement advanced Ansible automation Practice Test 2 — 15 Questions

Question 1

An Ansible playbook repeatedly uses the same pattern: check if a service is running, if not start it, and then verify it's running. Which three Ansible features can be used to reduce code duplication? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using a role with multiple tasks and handlers.. Option B is correct because a role packages reusable tasks, handlers, and defaults into a single unit, so the repeated check-start-verify sequence can be defined once and invoked from multiple plays, with handlers cleanly managing service restarts or state changes. Option E is correct because 'include_tasks' dynamically includes a common task file at runtime, and pairing it with a loop (e.g., 'loop' over service names) lets the same check-start-verify task file be reused for many services without duplicating YAML. Option A is not correct because 'include_vars' only loads external variable files into a play; it does not encapsulate or reuse task logic, so it cannot reduce duplication of the check-start-verify task sequence. Option C is not correct because the 'debug' module merely prints messages or variable values for troubleshooting and performs no service management or logic encapsulation. Option D is not correct because custom filter plugins transform data inside Jinja2 expressions; they cannot contain the multi-step task logic (service checks, starts, and verification) that this scenario requires.

Answer

Using 'include_vars' to reuse variable files.

Answer

Using 'debug' module to output the status.

Answer

Creating a custom filter plugin to encapsulate the logic.

Question 2

Refer to the exhibit. Which of the following is the most likely cause of this error?

Accepted Answer

The 'ask_become_pass' is set to 'false' and no become password is provided.. The error message indicates that Ansible is unable to authenticate with the remote host, which occurs when `ask_become_pass` is set to `false` (or defaults to `false` in some configurations) and no become password is provided via `--ask-become-pass` or an `ansible_become_password` variable. Without a password, the privilege escalation attempt fails, resulting in a permission denied error.

Answer

The playbook is running without '--become' flag.

Answer

The 'become_method' is set to 'su' instead of 'sudo'.

Answer

The 'ansible_become_password' was provided but incorrect.

Answer

The remote user is not in the sudoers file.

Question 3

Refer to the exhibit. A playbook targeting the 'webservers' group uses '{{ http_port }}'. What will be the value of 'http_port' on 'web2'?

Accepted Answer

8080. In Ansible, host variables take precedence over group variables. The inventory defines 'web2' with 'http_port: 8080' as a host variable, while the 'webservers' group defines 'http_port: 80' as a group variable. Since host variables override group variables, the value of 'http_port' on 'web2' is 8080.

Answer

80

Answer

80, because the group variable overrides host variable.

Answer

Undefined, causing an error

Question 4

An Ansible playbook uses the 'constructed' inventory plugin with 'keyed_groups' to create groups based on 'ansible_distribution'. Despite correct configuration, hosts are not assigned to the expected groups. What is the most likely cause?

Accepted Answer

the 'strict' option is set to 'yes' and the required facts are not gathered. 'strict: yes' causes plugin to fail on undefined variables; if facts are not gathered, 'ansible_distribution' is undefined. Options A, B, D are plausible but less likely.

Answer

the 'keyed_groups' syntax uses invalid Jinja2 expressions

Answer

the inventory file is incorrectly formatted

Answer

the plugin is not enabled in ansible.cfg

Question 5

An Ansible playbook uses a 'block' to group multiple tasks and includes a 'rescue' section. If a task inside the block fails, what will happen?

Accepted Answer

the rescue section runs, and the playbook continues with tasks after the block. When a task inside a block fails, Ansible executes the rescue section, and after rescue completes, the playbook continues with tasks after the block (C). The rescue block is designed to handle errors gracefully and allow the play to proceed, rather than aborting the entire run. This is the core semantics of block/rescue/always in Ansible.

Answer

the rescue section runs and then the playbook resumes with the next task after the block

Answer

the block is re-executed from the beginning

Answer

the playbook stops immediately

Question 6

An Ansible playbook sets a variable with a dictionary value in the play's vars and also in group_vars/all. When the play runs, the dictionary in group_vars completely replaces the one in play vars. What is the most likely reason?

Accepted Answer

Ansible's default variable precedence uses replacement, not merging, for dictionaries. Ansible's variable precedence rules determine that group_vars/all has higher precedence than play vars. When two variables with the same name are defined at different precedence levels, the higher-precedence variable completely replaces the lower-precedence one. This replacement behavior applies to all data types, including dictionaries; Ansible does not merge dictionaries by default. Therefore, the dictionary in group_vars/all overwrites the one in play vars entirely.

Answer

the playbook uses 'set_fact' which overrides all other vars

Answer

the play vars dictionary is defined with incorrect YAML syntax

Answer

the group_vars file uses a different variable name

Question 7

An Ansible playbook uses delegation to run a task on localhost while targeting remote hosts. The task fails with 'connection refused' for the remote host. What is the most likely cause?

Accepted Answer

the task uses 'connection: local' incorrectly or omits it. 'delegate_to: localhost' runs the task locally, but the connection keyword 'ansible_connection' may still refer to remote if not set correctly. Option A is plausible but less common. Options C and D are incorrect.

Answer

the remote host is not reachable from the control node

Answer

the playbook lacks 'gather_facts: yes'

Answer

the delegate host lacks required Python libraries

Question 8

Which TWO of the following are valid methods to include external variable files into an Ansible playbook?

Accepted Answer

using the 'include_vars' module. The 'include_vars' module dynamically loads variables from external files into a playbook at runtime, allowing for conditional or loop-based variable inclusion. Option E is correct because the 'vars_files' directive statically specifies external variable files to be parsed before task execution, a standard method for separating variable data from play logic.

Answer

using the 'add_host' module

Answer

using the 'set_fact' module

Answer

using '-e' command line option

Question 9

Refer to the exhibit. The playbook fails with this error. What is the most likely cause?

Accepted Answer

gather_facts is set to 'no'. When `gather_facts` is set to `no`, Ansible skips the fact-gathering step that populates variables like `ansible_facts['os_family']` or `ansible_distribution`. If the playbook or a role references a fact-based variable (e.g., in a `when` condition or template) that hasn't been collected, the task will fail with an 'undefined variable' error. This is the most likely cause because the error message typically indicates a missing variable, not a connectivity or inventory issue.

Answer

group_vars are not loaded

Answer

the host is unreachable

Answer

the inventory is missing the host

Question 10

Refer to the exhibit. An Ansible playbook targeting 'production' hosts fails with 'deploy_user is undefined'. What is the most likely cause?

Accepted Answer

the variable 'deploy_user' is not defined in any group or host vars. The error 'deploy_user is undefined' indicates that Ansible cannot find a value for the variable 'deploy_user' in any of the variable sources it searches. In Ansible, variables are resolved from group vars, host vars, play vars, and other sources with a specific precedence order. If the variable is not defined in any group or host vars file, nor in the inventory itself, Ansible will fail with an 'undefined variable' error. The exhibit shows a play targeting 'production' hosts, so the most likely cause is that no group or host var file defines 'deploy_user' for that group or its hosts.

Answer

the playbook uses a different group name in the play

Answer

the inventory file is missing the host entries

Answer

the variable is defined but overridden by a higher precedence variable

Question 11

An Ansible playbook uses the lineinfile module to ensure a specific line is present in a configuration file. However, after running the playbook multiple times, the line is duplicated each time. Which option best explains this behavior?

Accepted Answer

The lineinfile module is missing the regexp parameter, so it adds the line every run.. The lineinfile module uses the regexp parameter to search for an existing line before deciding whether to add it. Without regexp, Ansible cannot determine if the line already exists, so it appends the line on every run, causing duplication. The correct fix is to provide a regexp that matches the line (or a pattern) so the module can replace or skip it if already present.

Answer

The state parameter is set to 'append' instead of 'present'.

Answer

The backup parameter is not set, causing file corruption.

Answer

The insertafter parameter is incorrectly set to EOF, causing multiple adds.

Question 12

An Ansible role has tasks that need to run in a specific order, and some tasks must use a different shell interpreter. Which feature allows the role to control task execution order and environment settings?

Accepted Answer

Use the block directive to order tasks and a vars file for interpreter.. The block directive groups tasks and enforces their sequential execution order within the block, while a vars file can define environment settings such as ansible_python_interpreter or shell-specific variables. This combination directly addresses the need to control task order and interpreter settings at the role level. Blocks also allow error handling and conditional application, making them ideal for structured role execution.

Answer

Use the meta module to declare dependencies and the environment directive in tasks.

Answer

Use the strategy plugin and a custom lookup to set interpreter.

Answer

Use tags to control execution order and a custom inventory script.

Question 13

A system administrator uses the ansible-vault encrypt_string command to encrypt a sensitive variable. The variable is included in a playbook via a vars_prompt. When the playbook runs, the vault password is provided, but the playbook fails with 'Vault password is required for decryption' for the prompted variable. What is the most likely cause?

Accepted Answer

The vault-encrypted variable is used in a vars_prompt, which expects plaintext input; encrypted value cannot be prompted.. `vars_prompt` in Ansible expects plaintext input from the user at runtime, not an encrypted vault string. When you use `ansible-vault encrypt_string` to encrypt a variable and then reference that encrypted value in a `vars_prompt`, the prompt mechanism cannot decrypt it on the fly — it treats the encrypted blob as a literal string and fails with 'Vault password is required for decryption' because it attempts to decrypt the prompted input as if it were a vault-encrypted variable, but the prompt itself does not support vault decryption.

Answer

The variable is defined in a vault-encrypted file without a prompt.

Answer

The vault password file is corrupted or missing.

Answer

The encrypted string includes extra whitespace or quotes that cause parsing issues.

Question 14

An Ansible Tower/AWX job template uses a custom inventory script that dynamically queries an API. The script returns JSON including groups and hosts. Recently, the API started returning HTTP 500 errors intermittently, causing inventory sync failures. Which Ansible approach can make the inventory source more resilient?

Accepted Answer

Configure the inventory script to use the Ansible cache plugin with a timeout and fallback to cached data.. The Ansible cache plugin can store the results of a dynamic inventory script and serve them when the API is unavailable. By configuring a timeout and fallback to cached data, the job template avoids failures during transient HTTP 500 errors, ensuring inventory sync resilience without modifying the script itself.

Answer

Wrap the inventory script invocation in a Jinja2 template with error handling.

Answer

Use the setup module to gather facts and store them locally as a fallback inventory.

Answer

Modify the inventory script to retry on failure and write results to a static file.

Question 15

A playbook uses the 'win_chocolatey' module to install software on Windows hosts. The playbook is idempotent for most packages, but one package consistently fails with 'The package is already installed' error despite being reinstalled each run. Which approach ensures true idempotency?

Accepted Answer

Use a win_shell task with a check command to detect installation, and conditionally run the win_chocolatey task only when absent.. The win_chocolatey module's 'state=present' does not guarantee idempotency for all packages; some packages may not report their installed state correctly to Chocolatey, causing the module to attempt installation every run and fail with 'already installed'. By using a win_shell task with a check command (e.g., `choco list --local-only`) to detect installation and conditionally running the win_chocolatey task only when absent, you bypass the module's flawed state detection and achieve true idempotency.

Answer

Change state=present to state=latest to ensure the module only updates if needed.

Answer

Use the 'force' option in win_chocolatey to allow reinstalling, and ignore the error.

Answer

Add a 'when' condition to skip the package if it is already installed based on a registered variable from the win_chocolatey module's results.