EX294 Implement advanced Ansible automation Practice Test 6 — 15 Questions

Question 1

An Ansible playbook runs tasks on a group of web servers. During a rolling update, the playbook should ensure that no more than 2 servers are taken out of service at the same time. Which play keyword should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

serial: 2. The `serial` keyword controls the batch size of hosts that Ansible executes a play against. Setting `serial: 2` ensures that only 2 web servers are processed at a time, which is exactly what is needed for a rolling update where no more than 2 servers should be taken out of service simultaneously.

Answer

forks: 2

Answer

max_fail_percentage: 2

Answer

throttle: 2

Question 2

An administrator wants to reuse a set of tasks across multiple playbooks. Which Ansible approach is most appropriate?

Accepted Answer

Creating a role with tasks in tasks/main.yml.. Roles are the standard Ansible mechanism for packaging and reusing tasks, variables, handlers, and other automation content across multiple playbooks. By placing tasks in a role's `tasks/main.yml`, the administrator can reference that role in any playbook using the `roles:` directive, enabling clean, modular reuse without duplication.

Answer

Encrypting the tasks with Ansible Vault.

Answer

Using ansible-doc to document the tasks.

Answer

Writing a custom module in Python.

Question 3

A playbook uses 'vars_prompt' to ask for a confirmation before proceeding with destructive changes. However, when the playbook is run from a CI/CD pipeline, it hangs indefinitely. What is the best way to handle this?

Accepted Answer

Pass the variable via --extra-vars and modify the prompt to be conditional with 'when: variable is not defined'.. Passing the variable via --extra-vars and making the prompt conditional with 'when: variable is not defined' allows the pipeline to provide the variable non-interactively. Option A is unsafe. Option B's --check mode does not solve prompts. Option C is unrelated. Option D encrypts data but does not handle prompts. Therefore, E is best.

Answer

Remove the prompt and always proceed.

Answer

Set ANSIBLE_STDOUT_CALLBACK=unixy to avoid interactive prompts.

Answer

Encrypt the confirmation in vault and include it.

Answer

Use --check mode to simulate.

Question 4

A playbook uses the 'block' feature to group tasks and includes a 'rescue' section. If a task inside the block fails, what happens?

Accepted Answer

The rescue tasks run, and the play continues with the next task after the block.. In Ansible, when a task inside a `block` fails, the `rescue` section is executed to handle the failure. After the rescue tasks complete successfully, the play continues with the next task after the block, not from the beginning of the block. This behavior allows for error recovery without terminating the entire play.

Answer

The rescue tasks run, and then the entire playbook fails.

Answer

The rescue tasks are ignored and the play fails immediately.

Answer

The block is re-executed after rescue.

Question 5

Which three of the following are valid methods to pass variables to an Ansible playbook at runtime? (Choose three.)

Accepted Answer

Using '--extra-vars' command line option.. The `--extra-vars` (or `-e`) command-line option allows you to pass variables directly to an Ansible playbook at runtime. This overrides any previously defined variables and can accept key=value pairs or load from JSON/YAML files, making it the primary method for runtime variable injection.

Answer

Using '--ask-vault-pass' and storing variables in encrypted files.

Answer

Using 'environment' directive in the playbook.

Question 6

Refer to the exhibit. What is the purpose of the 'failed_when' condition?

Accepted Answer

It fails the task only if the return code is non-zero and the error does not indicate 'not installed'.. The 'failed_when' condition in Ansible allows you to define custom failure criteria for a task. In the exhibit, the condition 'failed_when: result.rc != 0 and "not installed" not in result.stderr' means the task will only be marked as failed if the return code is non-zero AND the error message does not contain the string 'not installed'. This is useful when a command returns a non-zero exit code for expected reasons (e.g., package not found), and you want to treat that as a non-failure.

Answer

It ensures the task never fails regardless of return code.

Answer

It fails the task only if the package is installed.

Answer

It fails the task if the package is not installed.

Question 7

A developer reports that a role's behavior is not as expected. They set a variable in the playbook's vars section, but the role still uses the value from its vars/main.yml. Which of the following explains this issue?

Accepted Answer

vars defined in roles/vars/main.yml have higher precedence than those in the playbook's vars section. In Ansible, variable precedence is hierarchical, and role defaults (roles/role_name/defaults/main.yml) have the lowest precedence, while role vars (roles/role_name/vars/main.yml) have a higher precedence than playbook-level vars. Since the developer set the variable in the playbook's vars section, but the role still uses the value from its vars/main.yml, this indicates that vars defined in roles/vars/main.yml override those in the playbook's vars section, making option D correct.

Answer

vars defined in the playbook have higher precedence than those in roles/vars/main.yml

Answer

vars defined in group_vars override both play and role vars

Answer

the playbook must use include_vars after the role to override

Question 8

An Ansible playbook uses async and poll to run a long-running task. The task reports 'async task did not complete within the requested time'. Which of the following is the most likely cause?

Accepted Answer

the async timeout value is set too short for the task duration. The error 'async task did not complete within the requested time' indicates that the async timeout value (set via the async parameter) is too short for the actual task duration. The poll interval does not affect the timeout; it only controls how often Ansible checks the task status. Option B is correct because increasing the async value allows the task more time to complete.

Answer

the poll interval is set too long

Answer

the async task requires become: yes

Answer

the host is unreachable

Question 9

An Ansible playbook uses a rolling update strategy with serial: 1. After the first host is updated, the playbook stops and shows 'PLAY RECAP' with only one host. What is the most likely reason?

Accepted Answer

the inventory contains only one host. The `serial: 1` directive in Ansible limits concurrency to one host at a time, but the playbook will still process all hosts in the inventory. If the playbook stops after the first host and shows PLAY RECAP with only one host, the most likely reason is that the inventory contains only one host. With a single host, the play executes on that host and then finishes. Option B accurately identifies this scenario.

Answer

the playbook has a 'failed_when' condition that stops execution

Answer

the play uses 'delegate_to' incorrectly

Answer

the playbook does not have any task that triggers the next batch, and 'serial' only controls concurrency, not retry

Question 10

An Ansible playbook contains many tasks. An administrator wants to run only a subset of tasks by passing '--tags ' at the command line. Which of the following must be added to the tasks?

Accepted Answer

a 'tags' directive on each task. The 'tags' directive is the only mechanism in Ansible that allows tasks to be selectively included or excluded when running a playbook with the '--tags' command-line option. By adding a 'tags' attribute to a task (e.g., 'tags: install'), the administrator can target that task specifically, and Ansible's task execution engine filters tasks based on the provided tags at runtime.

Answer

a 'name' with specific naming convention

Answer

a 'block' statement

Answer

a 'when' condition

Question 11

A role contains a handler. The playbook includes the role and also defines a task that notifies the same handler. When the playbook runs, the handler executes only once. Which of the following best explains this behavior?

Accepted Answer

handlers are deduplicated by name; multiple notifications trigger the handler only once per play. Ansible handlers are deduplicated by name within a play. When a handler is notified multiple times—whether from a role or a playbook task—it runs only once at the end of the play, after all tasks have completed. This prevents redundant executions and is a core design feature of Ansible's handler system.

Answer

the handler was already triggered by the role and is skipped for the play task

Answer

the role's handler uses 'listen' which overrides notifications

Answer

the playbook's task notifies a different handler with the same name

Question 12

Which THREE of the following are valid attributes of the ansible.builtin.service module?

Accepted Answer

state. The `state` attribute is a core parameter of the `ansible.builtin.service` module, used to define the desired service status (e.g., `started`, `stopped`, `restarted`, `reloaded`). This directly controls the service's runtime state on the target system.

Answer

pattern

Answer

runlevel

Question 13

Which TWO of the following are correct about Ansible Vault?

Accepted Answer

the vault password can be provided via the '--vault-password-file' option. The `--vault-password-file` option allows Ansible to read the vault password from a file, which is a standard method for providing the password non-interactively, especially in automation scripts or CI/CD pipelines. This avoids the need for manual password entry and supports secure password management.

Answer

vault encryption is irreversible

Answer

vault encrypted files cannot be edited in place

Answer

vault can encrypt only specific variable values within a file

Question 14

Refer to the exhibit. An administrator wants to view the decrypted value of 'db_password' without modifying the file. Which command should be used?

Accepted Answer

ansible-vault view file.yml. The `ansible-vault view` command decrypts the file in memory and displays its contents to stdout without modifying the encrypted file on disk. This is the correct choice because the administrator only needs to see the decrypted value of 'db_password' and does not want to change the file.

Answer

ansible-vault rekey file.yml

Answer

ansible-vault decrypt file.yml

Answer

ansible-vault edit file.yml

Question 15

An automation engineer wants to run a playbook only on hosts that belong to both the 'webservers' group and the 'production' group. Which inventory grouping method achieves this?

Accepted Answer

webservers:&production. In Ansible, the '&' operator is used to intersect groups. 'webservers:&production' targets hosts that are in both the 'webservers' and 'production' groups. Option B is wrong because 'webservers:production' uses ':' which is a union operator, meaning hosts in either group. Option C is wrong because 'webservers:!production' uses '!' to exclude hosts in production. Option D is wrong because 'webservers+,production' is not a valid inventory pattern; Ansible does not support '+' for group intersection.

Answer

webservers:production

Answer

webservers:!production

Answer

webservers+,production