EX294 Implement advanced Ansible automation Practice Test 5 — 15 Questions

Question 1

An Ansible role has tasks that need to run in a specific order, and some tasks must use a different shell interpreter. Which feature allows the role to control task execution order and environment settings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the block directive to order tasks and a vars file for interpreter.. The block directive groups tasks that run in the order they appear, allowing control over task execution order within a role. Environment settings, such as a different shell interpreter, can be achieved using a vars file to define variables like ansible_shell_executable, which applies to tasks in the block. Option A is incorrect because the meta module (ansible.builtin.meta) does not declare role dependencies; role dependencies are defined in meta/main.yml. Options B and C are incorrect as strategy plugins and tags do not directly control task order or interpreter settings.

Answer

Use the meta module to declare dependencies and the environment directive in tasks.

Answer

Use the strategy plugin and a custom lookup to set interpreter.

Answer

Use tags to control execution order and a custom inventory script.

Question 2

A playbook uses a loop over a list of packages to ensure they are installed. However, the playbook runs slowly because each package is processed individually. Which optimization technique should be used to improve performance?

Accepted Answer

Pass the entire list to the package module's 'name' parameter instead of looping.. Ansible's package modules (such as yum, apt, or dnf) accept a list of packages in the 'name' parameter. Passing the entire list in a single task eliminates the overhead of multiple task executions, SSH connection reuse, and module setup/teardown that occur with each iteration in a loop. This reduces the number of Ansible task runs from N to 1, significantly improving performance.

Answer

Use with_items instead of loop; with_items is faster.

Answer

Set the async parameter on the looped task to run packages in parallel.

Answer

Use the serial keyword at the play level to increase parallelism.

Question 3

An Ansible Tower/AWX job template uses a custom inventory script that dynamically queries an API. The script returns JSON including groups and hosts. Recently, the API started returning HTTP 500 errors intermittently, causing inventory sync failures. Which Ansible approach can make the inventory source more resilient?

Accepted Answer

Configure the inventory script to use the Ansible cache plugin with a timeout and fallback to cached data.. The Ansible cache plugin can store the results of a dynamic inventory script and serve them when the API is unavailable. By configuring a timeout and fallback to cached data, the job template avoids failures during transient HTTP 500 errors, ensuring inventory sync resilience without modifying the script itself.

Answer

Wrap the inventory script invocation in a Jinja2 template with error handling.

Answer

Use the setup module to gather facts and store them locally as a fallback inventory.

Answer

Modify the inventory script to retry on failure and write results to a static file.

Question 4

A playbook uses the 'win_chocolatey' module to install software on Windows hosts. The playbook is idempotent for most packages, but one package consistently fails with 'The package is already installed' error despite being reinstalled each run. Which approach ensures true idempotency?

Accepted Answer

Use a win_shell task with a check command to detect installation, and conditionally run the win_chocolatey task only when absent.. The win_chocolatey module's 'state=present' does not guarantee idempotency for all packages; some packages may not report their installed state correctly to Chocolatey, causing the module to attempt installation every run and fail with 'already installed'. By using a win_shell task with a check command (e.g., `choco list --local-only`) to detect installation and conditionally running the win_chocolatey task only when absent, you bypass the module's flawed state detection and achieve true idempotency.

Answer

Change state=present to state=latest to ensure the module only updates if needed.

Answer

Use the 'force' option in win_chocolatey to allow reinstalling, and ignore the error.

Answer

Add a 'when' condition to skip the package if it is already installed based on a registered variable from the win_chocolatey module's results.

Question 5

Which TWO statements about Ansible roles are correct?

Accepted Answer

Ansible roles follow a predefined directory structure.. Ansible roles enforce a predefined directory structure (e.g., tasks/, handlers/, vars/, defaults/, meta/, templates/, files/) that organizes automation content into reusable components. This structure is required for Ansible to automatically locate and load role resources, making option A correct.

Answer

Roles enforce an execution order for tasks based on file naming.

Answer

A role can only be included once in a playbook.

Answer

Roles cannot have dependencies on other roles.

Question 6

Which TWO conditions are necessary for the 'local_action' directive to work as intended?

Accepted Answer

The task must be executed on the Ansible control node.. Options C and E are correct. For the 'local_action' directive to work as intended, the task must be executed on the Ansible control node (C) because local_action delegates the task to localhost. Additionally, the connection plugin must be set to 'local' (E) because local_action uses the local connection plugin to run commands on the control node without SSH. Option A is incorrect because local_action does not require an inventory entry for the control node; it implicitly uses localhost. Option B is incorrect because privilege escalation (become) is not a requirement for local_action; it can be used independently. Option D is incorrect because local_action is a shorthand directive, not a module; it is used instead of the 'action' keyword with delegate_to: localhost, but the key is that it runs locally with the local connection.

Answer

The inventory must contain an entry for the control node.

Answer

The task must have privilege escalation (become) enabled.

Answer

The 'local_action' module must be used instead of 'action'.

Question 7

Which THREE factors are essential for achieving idempotent behavior in Ansible plays?

Accepted Answer

Task execution order should not affect the final state.. Options A, B, and E are correct for achieving idempotent behavior in Ansible plays. A is correct because idempotent tasks should produce the same final state regardless of the order they are executed; this ensures consistency across multiple runs. B is correct because idempotent modules check the current state before making any changes, only acting when the desired state differs, which is fundamental to idempotency. E is correct because 'ignore_errors' should be used sparingly; overusing it can mask failures that would otherwise leave the system in a non-idempotent state, as subsequent runs may not correct hidden issues. C is incorrect because registered variables can be used in an idempotent manner; they do not inherently break idempotency. D is incorrect because loops can be idempotent if the module inside the loop is idempotent and the loop is designed to handle conditional changes.

Answer

Variables registered from previous tasks should be avoided.

Answer

Loops must be avoided because they always cause changes.

Question 8

Given the inventory above, which user will Ansible use when connecting to 'web2'?

Accepted Answer

deploy. The group vars for webservers set ansible_user=deploy. Option A is wrong because host vars are not set. Option B is wrong because root is default only if not set. Option D is wrong because dbadmin is for dbservers.

Answer

dbadmin

Answer

The system default user from ansible.cfg.

Answer

root

Question 9

The playbook above fails with 'template source file not found' for the copy task. Which change should be made to fix it?

Accepted Answer

Use the 'template' module instead of 'copy' for .j2 files.. The 'copy' module does not render Jinja2 templates; it simply copies files as is. When using a .j2 file with the copy module, Ansible expects the source file to exist literally, but it looks for the template in the wrong location, causing the 'template source file not found' error. The 'template' module is designed to process .j2 files, applying variables and Jinja2 logic, and then copying the result to the remote host. Therefore, replacing 'copy' with 'template' resolves the issue.

Answer

Add 'delegate_to: localhost' to copy the file from the control node.

Answer

Set 'backup: no' because backup creates additional files.

Answer

Set 'gather_facts: yes' to allow Ansible to locate the template.

Question 10

Given the command and error above, what is the most likely cause of the failure?

Accepted Answer

The --vault-id syntax is incorrect; 'vault@prompt' should be a label and password source, not a vault file.. The `--vault-id` option expects a label and a password source (e.g., `vault@prompt` means the label is 'vault' and the password is prompted interactively). The error indicates that Ansible is interpreting the entire string as a vault file path, which fails because no file named 'vault@prompt' exists. Option C correctly identifies that the syntax is being misapplied.

Answer

The vault file 'vault@prompt' does not exist.

Answer

The vault password file must be encrypted with ansible-vault.

Answer

The --check flag is incompatible with vault encryption.

Question 11

An administrator needs to securely store a database password used across multiple roles in a shared repository. Which approach is recommended?

Accepted Answer

Use ansible-vault to encrypt the password string and store it in a file, then include_vars.. Ansible-vault encrypts sensitive data at rest using AES-256, and the encrypted file can be safely stored in a shared repository. The `include_vars` module then decrypts the file at runtime when the vault password is provided, allowing multiple roles to access the password without exposing it in plaintext.

Answer

Use a lookup plugin to fetch from a secrets manager.

Answer

Store the password in an environment variable on the controller.

Answer

Hardcode the password in the playbook and use .gitignore.

Question 12

A playbook uses import_playbook to include other playbooks. The main playbook is run with --check mode. Which statement is true?

Accepted Answer

Imported playbooks are also run in check mode.. When a playbook uses `import_playbook`, the imported playbooks are statically included at parse time, meaning they become part of the main playbook's play structure. The `--check` mode flag applies to the entire playbook execution, so all imported playbooks also run in check mode. Option D is correct because Ansible propagates the check mode flag to all imported plays.

Answer

Only the main playbook runs in check mode; imported ones run normally.

Answer

All imported playbooks are skipped because import happens at parse time.

Answer

import_playbook does not support check mode.

Question 13

A company uses dynamic inventory from a cloud provider. The playbook needs to run tasks only on instances with a specific tag. The ansible_ec2_tags variable is not available. What is the most efficient method to filter hosts?

Accepted Answer

Use the amazon.aws.aws_ec2 inventory plugin with compose and keyed_groups.. The `amazon.aws.aws_ec2` inventory plugin can dynamically filter EC2 instances by tag using `keyed_groups` and `compose` at inventory build time, avoiding runtime overhead. This is the most efficient method as it pre-filters hosts before the playbook runs, unlike runtime fact gathering or lookups.

Answer

Use the hostvars lookup to check tags.

Answer

Use the ec2_instance_facts module inside the playbook to gather facts and filter.

Answer

Use a static inventory file with hosts pre-filtered.

Question 14

A playbook uses serial: 2 and sets any_errors_fatal: true. The first batch of 2 hosts both fail. What happens?

Accepted Answer

The playbook aborts and no further batches run.. When `any_errors_fatal: true` is set and a batch of hosts fails, Ansible immediately aborts the entire playbook run for all remaining hosts, regardless of the `serial` setting. Since the first batch of 2 hosts both fail, no further batches are executed. This behavior is designed to prevent cascading failures in critical deployments.

Answer

The playbook continues with the next batch.

Answer

The playbook marks the batch as unreachable and continues.

Answer

The playbook retries the failed hosts.

Question 15

A playbook uses an Ansible collection that includes a custom module. The module's documentation is missing. What is the best way to locate the module's source code?

Accepted Answer

Navigate to the collection's plugin directory on the control node.. The source code for custom modules in an Ansible collection is located in the collection's plugin directory on the control node. Option A is not the best choice because `ansible-doc` relies on documentation strings; if the module's documentation is missing, it may not provide useful information. Option B is incorrect because the Ansible Galaxy website hosts collections but does not necessarily provide direct access to source code without documentation. Option D is wrong because the roles directory contains roles, not module plugins.

Answer

Run ansible-doc <module name>.

Answer

Search the Ansible Galaxy website.

Answer

Look in the roles directory.