EX294 Implement advanced Ansible automation Practice Test 5 — 15 Questions

Question 1

A system administrator uses the ansible-vault encrypt_string command to encrypt a sensitive variable. The variable is included in a playbook via a vars_prompt. When the playbook runs, the vault password is provided, but the playbook fails with 'Vault password is required for decryption' for the prompted variable. What is the most likely cause?

Accepted Answer

The vault-encrypted variable is used in a vars_prompt, which expects plaintext input; encrypted value cannot be prompted.. Option C is correct because ansible-vault encrypt_string creates a variable that is automatically decrypted only if it's stored in a file or passed via --extra-vars; vars_prompt requires the variable to be entered manually, so the vault-encrypted value is not usable. Option A is wrong because the prompt is defined as prompted variable, not from file. Option B is wrong because the vault password is provided. Option D is wrong because the variable is encrypted, not wrapped in other quotes.

Answer

The variable is defined in a vault-encrypted file without a prompt.

Answer

The vault password file is corrupted or missing.

Answer

The encrypted string includes extra whitespace or quotes that cause parsing issues.

Question 2

An Ansible Tower/AWX job template uses a custom inventory script that dynamically queries an API. The script returns JSON including groups and hosts. Recently, the API started returning HTTP 500 errors intermittently, causing inventory sync failures. Which Ansible approach can make the inventory source more resilient?

Accepted Answer

Configure the inventory script to use the Ansible cache plugin with a timeout and fallback to cached data.. Option A is correct because using a cache plugin with a long timeout reduces API calls and tolerates intermittent failures. Option B is wrong because templates don't handle API errors. Option C is wrong because facts don't prevent sync failures. Option D is wrong because it adds complexity and doesn't improve resilience.

Answer

Wrap the inventory script invocation in a Jinja2 template with error handling.

Answer

Use the setup module to gather facts and store them locally as a fallback inventory.

Answer

Modify the inventory script to retry on failure and write results to a static file.

Question 3

A playbook uses the 'win_chocolatey' module to install software on Windows hosts. The playbook is idempotent for most packages, but one package consistently fails with 'The package is already installed' error despite being reinstalled each run. Which approach ensures true idempotency?

Accepted Answer

Use a win_shell task with a check command to detect installation, and conditionally run the win_chocolatey task only when absent.. Option D is correct because win_chocolatey with state=latest will upgrade if needed, but for idempotency, using state=present with choco upgrade command is not needed; the real issue is that the module might not detect the installation correctly. Using win_shell to check before install is more reliable. Option A is wrong because it does not check. Option B is wrong because it triggers upgrade every time. Option C is wrong because it forces reinstall.

Answer

Change state=present to state=latest to ensure the module only updates if needed.

Answer

Use the 'force' option in win_chocolatey to allow reinstalling, and ignore the error.

Answer

Add a 'when' condition to skip the package if it is already installed based on a registered variable from the win_chocolatey module's results.

Question 4

Which TWO statements about Ansible roles are correct?

Accepted Answer

Ansible roles follow a predefined directory structure.. Options A and C are correct. A: Roles can be shared via Ansible Galaxy. C: The directory structure is defined by Ansible. B is wrong because roles do not enforce a specific order; tasks run in order of main.yml. D is wrong because roles can have dependencies defined in meta. E is wrong because roles can be used multiple times in a play.

Answer

Roles enforce an execution order for tasks based on file naming.

Answer

A role can only be included once in a playbook.

Answer

Roles cannot have dependencies on other roles.

Question 5

Which TWO conditions are necessary for the 'local_action' directive to work as intended?

Accepted Answer

The task must be executed on the Ansible control node.. Options B and D are correct. B: The task must be run on the control node, so delegation is implied. D: local_action uses the local connection plugin, which typically uses the 'local' connection, not SSH. A is wrong because local_action does not require become. C is wrong because inventory is not required for local_action. E is wrong because there is no 'local' module; it's a directive.

Answer

The inventory must contain an entry for the control node.

Answer

The task must have privilege escalation (become) enabled.

Answer

The 'local_action' module must be used instead of 'action'.

Question 6

Which THREE factors are essential for achieving idempotent behavior in Ansible plays?

Accepted Answer

Task execution order should not affect the final state.. Options A, C, and D are correct. A: Modules should check current state before making changes. C: Tasks should not rely on the order of execution across hosts. D: Avoid using 'ignore_errors' carelessly as it can mask failures and prevent idempotency. B is wrong because loops can be idempotent if designed correctly. E is wrong because register variables can be used idempotently.

Answer

Variables registered from previous tasks should be avoided.

Answer

Loops must be avoided because they always cause changes.

Question 7

Given the inventory above, which user will Ansible use when connecting to 'web2'?

Accepted Answer

deploy. Option C is correct because the group vars for webservers set ansible_user=deploy. Option A is wrong because host vars are not set. Option B is wrong because root is default only if not set. Option D is wrong because dbadmin is for dbservers.

Answer

dbadmin

Answer

The system default user from ansible.cfg.

Answer

root

Question 8

The playbook above fails with 'template source file not found' for the copy task. Which change should be made to fix it?

Accepted Answer

Use the 'template' module instead of 'copy' for .j2 files.. Option D is correct because the template module should be used to render .j2 files. Option A is wrong because the file exists on the control node, not remote. Option B is wrong because backup is not related. Option C is wrong because facts are not required to find the source.

Answer

Add 'delegate_to: localhost' to copy the file from the control node.

Answer

Set 'backup: no' because backup creates additional files.

Answer

Set 'gather_facts: yes' to allow Ansible to locate the template.

Question 9

Given the command and error above, what is the most likely cause of the failure?

Accepted Answer

The --vault-id syntax is incorrect; 'vault@prompt' should be a label and password source, not a vault file.. Option D is correct because --vault-id expects a password source, not an encrypted file; the vault file itself should not be specified as a vault-id. Option A is wrong because --check should work. Option B is wrong because the vault file exists. Option C is wrong because encryption is needed, but the error message says the vault password must be encrypted, which is misleading; actually the vault-id parameter is misused.

Answer

The vault file 'vault@prompt' does not exist.

Answer

The vault password file must be encrypted with ansible-vault.

Answer

The --check flag is incompatible with vault encryption.

Question 10

An administrator needs to securely store a database password used across multiple roles in a shared repository. Which approach is recommended?

Accepted Answer

Use ansible-vault to encrypt the password string and store it in a file, then include_vars.. Option A is correct because ansible-vault encrypts the variable and can be decrypted at runtime. Option B is insecure. Option C is not portable. Option D is valid but not covered in core RHCE.

Answer

Use a lookup plugin to fetch from a secrets manager.

Answer

Store the password in an environment variable on the controller.

Answer

Hardcode the password in the playbook and use .gitignore.

Question 11

A playbook uses import_playbook to include other playbooks. The main playbook is run with --check mode. Which statement is true?

Accepted Answer

Imported playbooks are also run in check mode.. Option C is correct because import_playbook includes tasks at parse time, so check mode applies to all tasks. Option A is wrong because imported playbooks are not skipped. Option B is wrong because check mode applies to all plays. Option D is wrong because import_playbook supports check mode.

Answer

Only the main playbook runs in check mode; imported ones run normally.

Answer

All imported playbooks are skipped because import happens at parse time.

Answer

import_playbook does not support check mode.

Question 12

A company uses dynamic inventory from a cloud provider. The playbook needs to run tasks only on instances with a specific tag. The ansible_ec2_tags variable is not available. What is the most efficient method to filter hosts?

Accepted Answer

Use the amazon.aws.aws_ec2 inventory plugin with compose and keyed_groups.. Option C is correct because using the aws_ec2 inventory plugin with compose and keyed_groups allows pre-filtering hosts efficiently. Option A is inefficient as it runs a task on all hosts. Option B may not have the variable available. Option D requires manual maintenance.

Answer

Use the hostvars lookup to check tags.

Answer

Use the ec2_instance_facts module inside the playbook to gather facts and filter.

Answer

Use a static inventory file with hosts pre-filtered.

Question 13

An organization has a set of common tasks used in many playbooks. The tasks are updated frequently. What is the most maintainable way to share them?

Accepted Answer

Package the tasks into a collection and install it via ansible-galaxy.. Option D is correct because packaging tasks into a collection and distributing via ansible-galaxy allows versioned, maintainable sharing. Option A leads to duplication. Option B requires manual updates. Option C is fragile with relative paths.

Answer

Create a role and store it in a local directory referenced by ansible.cfg.

Answer

Copy the task files into each project repository.

Answer

Use include_tasks with a relative path from each playbook.

Question 14

A playbook uses serial: 2 and sets any_errors_fatal: true. The first batch of 2 hosts both fail. What happens?

Accepted Answer

The playbook aborts and no further batches run.. Option A is correct because any_errors_fatal causes the play to abort on any failure when serial is used. Option B is wrong because fatal errors halt execution. Option C is wrong because there is no automatic retry. Option D is wrong because it marks as unreachable but still aborts.

Answer

The playbook continues with the next batch.

Answer

The playbook marks the batch as unreachable and continues.

Answer

The playbook retries the failed hosts.

Question 15

A playbook uses an Ansible collection that includes a custom module. The module's documentation is missing. What is the best way to locate the module's source code?

Accepted Answer

Navigate to the collection's plugin directory on the control node.. Option D is correct because the source code is in the collection's plugin directory on the control node. Option A may not find it if it's local. Option B may not show source without docs. Option C is wrong because roles are separate.

Answer

Run ansible-doc <module name>.

Answer

Search the Ansible Galaxy website.

Answer

Look in the roles directory.