EX294 Implement advanced Ansible automation Practice Test 5 — 15 Questions

Question 1

An administrator wants to reuse a set of tasks that configure a firewall across multiple playbooks. Which Ansible feature should be used to achieve this?

Accepted Answer

Create a role for firewall configuration.. A role is the correct Ansible feature for reusing a set of tasks across multiple playbooks. Roles provide a structured, self-contained directory layout for tasks, handlers, variables, templates, and files, allowing the firewall configuration logic to be packaged once and referenced in any playbook via the `roles:` directive or `import_role`/`include_role` modules.

Answer

Add the tasks to the inventory file under a group.

Answer

Define the tasks in a vars file and include it.

Answer

Define the tasks as handlers and notify them.

Question 2

A playbook uses the 'include_tasks' module to dynamically include tasks based on a variable. The playbook runs successfully on some hosts but fails on others with a 'template error' message. What is the most likely cause?

Accepted Answer

The variable used in the 'include_tasks' path has a Jinja2 template error.. The 'include_tasks' module dynamically resolves the path to a task file using a variable. If that variable contains a Jinja2 template error (e.g., undefined variable, syntax mistake, or filter misuse), Ansible will fail with a 'template error' message during the variable expansion phase, before the task file is even loaded. This explains why the error occurs only on hosts where the variable's value or context triggers the template failure.

Answer

The included task file does not exist on the control node.

Answer

The included task file has incorrect permissions.

Answer

The included tasks contain a syntax error.

Question 3

An Ansible playbook is designed to run on a group of database servers. The administrator wants to ensure that a task runs only on the primary database server, which is defined in the inventory with a variable 'primary: true'. Which conditional should be used?

Accepted Answer

when: primary. The `when` conditional in Ansible evaluates a Jinja2 expression to determine whether a task should execute. By using `when: primary`, the task will run only on hosts where the inventory variable `primary` is defined and evaluates to `true` (a truthy value). This directly meets the requirement to target the primary database server.

Answer

ignore_errors: yes

Answer

run_once: true

Answer

delegate_to: "{{ primary }}"

Question 4

A playbook uses the 'block' and 'rescue' keywords to handle errors. The block contains three tasks. The first task fails. What happens next?

Accepted Answer

The rescue section runs immediately after the failure.. In Ansible, when a task inside a `block` fails, the `rescue` section is executed immediately after the failure, without running any remaining tasks in the block. This is analogous to a try-catch mechanism in programming: the block is the 'try', and the rescue is the 'catch'. Option B correctly describes this behavior.

Answer

The rescue section runs and retries the failed task.

Answer

The playbook fails with an error message.

Answer

The remaining tasks in the block run, then the rescue section runs.

Question 5

An administrator needs to securely pass a database password to a playbook without exposing it in logs or the command line. Which approach is the most secure?

Accepted Answer

Store the password in an Ansible Vault-encrypted variable file and include it.. Ansible Vault encrypts the variable file at rest, and including it via `vars_files` or `include_vars` decrypts it only in memory during playbook execution. This prevents the password from appearing in logs, the command line, or the process table, meeting the security requirement.

Answer

Set the password in a variable and use 'no_log: true' on tasks that use it.

Answer

Store the password in a host_vars file with restricted file permissions.

Answer

Prompt for the password and pass it as an extra variable using -e.

Question 6

An Ansible playbook includes a role that defines default variables in 'defaults/main.yml' and role variables in 'vars/main.yml'. A playbook sets the same variable in the play's 'vars' section. Which variable value takes precedence?

Accepted Answer

Play vars. In Ansible, variable precedence is hierarchical, and play vars (set directly in the play's `vars` section) have a higher priority than role defaults and role vars. Specifically, play vars override role vars, which in turn override role defaults. Therefore, when the same variable is defined in all three locations, the play vars value takes precedence.

Answer

Role defaults

Answer

Inventory group vars

Answer

Role vars

Question 7

Which TWO statements about Ansible collections are correct?

Accepted Answer

Collections provide a way to package and distribute Ansible content.. Option B is correct because Ansible collections are the standard packaging format for distributing Ansible content, bundling modules, roles, plugins, playbooks, and documentation into a single installable unit that can be shared via namespaces. Option E is correct because collections can be published to and installed from public Ansible Galaxy or Red Hat Automation Hub (and private Automation Hub), typically using commands like 'ansible-galaxy collection install' with a namespace.collection name. Option A is incorrect because collections are versioned using semantic versioning (e.g., 1.2.0) in their galaxy.yml and requirements files. Option C is incorrect because inventory files define managed hosts and remain necessary; collections do not replace them. Option D is incorrect because collections can contain many content types beyond modules and roles, including plugins, module utilities, and documentation.

Answer

Collections cannot be versioned.

Answer

Collections replace the need for inventory files.

Answer

Collections can only contain modules and roles.

Question 8

Which THREE of the following are valid uses of the 'ansible.builtin.include_role' module?

Accepted Answer

Pass variables to the included role using the 'vars' keyword.. The 'ansible.builtin.include_role' module supports the 'vars' keyword to pass variables directly to the included role. This allows you to override or supply role variables at the point of inclusion, which is a common pattern for reusing roles with different configurations.

Answer

Dynamically set the role name using a variable without the 'name' parameter.

Answer

Apply tags to all tasks within the included role.

Question 9

Which TWO of the following are advantages of using 'ansible-pull' over 'ansible-playbook'?

Accepted Answer

It can be used in environments where a central control node is not desired.. Option A is correct because ansible-pull is designed for decentralized setups: each managed host runs the ansible-pull command itself, fetching and executing a playbook from a git repository, so no persistent central control node is required to push configurations. Option C is correct because ansible-pull's core behavior is exactly that nodes self-configure by cloning or updating a playbook from a git repository (via the -U/--url option) and then running it locally with ansible-playbook under the hood. Option B is not a real advantage: ansible-pull still relies on an inventory (typically localhost or a local inventory file) to determine targets, so it does not eliminate inventory usage. Option D is false because ansible-pull uses the same YAML playbook syntax as ansible-playbook; there is no separate, more efficient syntax. Option E is misleading: although execution happens locally, ansible-pull does not inherently reduce control-node load as a designed advantage, and the question asks for advantages over ansible-playbook, which is not established by this option.

Answer

It eliminates the need for an inventory file.

Answer

It supports a different syntax for playbooks that is more efficient.

Answer

It reduces load on the control node because it runs locally on each node.

Question 10

You are managing a large infrastructure of 500 Linux servers. The servers are divided into groups: 'web', 'app', and 'db'. Each group has specific configuration requirements. You have developed a set of Ansible roles to manage these configurations. Recently, you noticed that when you run the playbook against all servers, the 'web' role is applied to 'app' servers due to a variable misconfiguration. The playbook uses include_role with a variable that determines which role to apply. The variable is defined in group_vars/all.yml as 'server_role: web'. However, each group should have its own role: 'web' for web servers, 'app' for app servers, 'db' for db servers. The playbook includes the role based on '{{ server_role }}'. What is the best course of action to fix this issue without modifying the playbook structure?

Accepted Answer

Define the server_role variable in group_vars/web.yml, group_vars/app.yml, and group_vars/db.yml with the appropriate values.. Ansible's variable precedence dictates that group_vars/<group_name>.yml files override group_vars/all.yml for hosts in that group. By defining `server_role` per group file (web, app, db), each server gets the correct role without modifying the playbook structure. This leverages Ansible's built-in group variable inheritance to resolve the misconfiguration cleanly.

Answer

Change the variable in group_vars/all.yml to a list and use 'include_role' with loop.

Answer

Add a 'when' condition to the include_role task to check the group name.

Answer

Define the server_role in host_vars for each server.

Question 11

An Ansible automation team is designing a playbook to manage network devices. They need to ensure that the playbook can handle transient network failures by retrying failed tasks a specific number of times with a delay between retries. Which approach should they use?

Accepted Answer

Use the `until` loop with `retries` and `delay` parameters on the task.. The `until` loop with `retries` and `delay` parameters is the correct approach because it allows a task to be retried a specified number of times with a configurable pause between attempts, directly addressing transient network failures. This is a built-in Ansible feature for handling intermittent issues without additional error-handling constructs.

Answer

Set `max_fail_percentage` in the play to 0 and use `ignore_errors: yes` with a rescue block.

Answer

Use the `throttle` keyword to limit concurrent tasks and rely on idempotency.

Answer

Set `serial: 1` on the play to ensure only one host is processed at a time and rely on idempotency.

Question 12

An Ansible playbook that deploys a web application includes a task that uses the `uri` module to call an external API. The task occasionally fails due to API rate limiting. Which combination of keywords should be added to the task to automatically retry up to 5 times with a 30-second delay between attempts, and only fail if all retries are exhausted?

Accepted Answer

`register: result`, `until: result.status == 200`, `retries: 5`, `delay: 30`. It combines `register` to capture the API response, `until` to check that `result.status` equals 200 (the HTTP success code), `retries: 5` to attempt the task up to five times, and `delay: 30` to wait 30 seconds between retries. This ensures the task only fails after all five retries are exhausted, which is the exact behavior needed to handle transient API rate limiting.

Answer

`register: result`, `until: status == 200`, `retries: 5`, `delay: 30`

Answer

`until: result.status == 200`, `retries: 5`, `delay: 30`

Answer

`register: result`, `retries: 5`, `delay: 30`

Question 13

Drag and drop the steps to configure a network bond (bond0) using nmcli in the correct order.

Accepted Answer

1. Create bond connection; 2. Add slave interfaces; 3. Set bonding mode; 4. Activate bond; 5. Verify bond status. The correct order to configure a network bond using nmcli is: create the bond connection first, then add slave interfaces to it, set the bonding mode (e.g., active-backup), activate the bond, and finally verify the bond status. This sequence ensures that the bond interface exists before adding slaves and that the mode is set before activation so that the bond operates correctly from the start.

Answer

1. Create bond connection; 2. Add slave interfaces; 3. Activate bond; 4. Set bonding mode; 5. Verify bond status

Answer

1. Set bonding mode; 2. Create bond connection; 3. Add slave interfaces; 4. Activate bond; 5. Verify bond status

Answer

1. Add slave interfaces; 2. Create bond connection; 3. Activate bond; 4. Set bonding mode; 5. Verify bond status

Question 14

Match each Ansible fact variable to its description.

Accepted Answer

ansible_distribution: The name of the operating system distribution (e.g., RedHat, Ubuntu). The correct matches are: ansible_distribution -> OS distribution name, ansible_os_family -> OS family, ansible_architecture -> CPU architecture. Common confusions include mistaking memory units (MB vs GB) and hostname vs IP address.

Answer

ansible_memtotal_mb: Total memory in gigabytes

Answer

ansible_hostname: The IP address of the managed node

Question 15

A team wants to ensure that a sensitive variable, such as a database password, is not printed when ansible-playbook runs with -v (verbose). What is the best method to achieve this?

Accepted Answer

Use the 'no_log: true' directive on the task.. The `no_log: true` directive explicitly prevents Ansible from printing the value of any variable used in that task to the console, even when verbosity is increased with `-v`. This is the most direct and secure method to ensure sensitive data like passwords are not exposed in output logs, as it overrides the default logging behavior at the task level.

Answer

Set the password as an environment variable on the control node.

Answer

Store the password in a file with 0600 permissions and use lookup('file', ...).

Answer

Use the 'ansible-vault encrypt_string' command and reference the variable from a vault file.