EX294 Implement advanced Ansible automation Practice Test 6 — 15 Questions

Question 1

An administrator wants to run a playbook with a different user for a specific host. Which variable should be set?

Accepted Answer

ansible_user. Ansible_user sets the remote user for SSH connections to the target host. Option B (ansible_user_id) is a fact variable that returns the UID of the user running the task on the remote host, not the connection user. Option C (ansible_ssh_user) is a deprecated alias for ansible_user. Option D (ansible_remote_user) is also a deprecated alias.

Answer

ansible_user_id

Answer

ansible_ssh_user

Answer

ansible_remote_user

Question 2

A playbook uses the 'block' and 'rescue' keywords. If a task in the block fails, but the rescue tasks also fail, what happens?

Accepted Answer

The play fails.. When a task in a block fails, the rescue tasks execute. If the rescue tasks also fail, the entire play fails (the failure propagates). Option B is incorrect because the play does not continue; it fails. Option C is incorrect because the block is not re-executed; rescue only runs once. Option D is incorrect because rescue tasks are not retried after failure.

Answer

The play continues to the next task.

Answer

The block is re-executed.

Answer

The rescue tasks are retried.

Question 3

Which two statements about Ansible roles are correct? (Select exactly 2.)

Accepted Answer

Roles can include tasks, handlers, variables, and defaults.. Options C and E are correct. Roles can contain tasks, handlers, variables, and defaults (C). Roles can be installed from Ansible Galaxy (E). Option A is incorrect because the meta/main.yml file is optional, not mandatory. Option B is incorrect because roles are not a type of playbook; they are a way to organize playbook content. Option D is incorrect because roles can be used with include_role or import_role.

Answer

Roles must have a meta/main.yml file.

Answer

Roles are a type of playbook.

Answer

Roles cannot be used with include_role.

Question 4

Which three methods can be used to pass variables to an Ansible playbook? (Select exactly 3.)

Accepted Answer

In the playbook's vars_files directive.. The `vars_files` directive in a playbook allows you to specify external YAML or JSON files containing variables, which are then merged into the play's variable scope at runtime. This is a standard method for passing variables to a playbook, as it separates variable definitions from the playbook logic.

Answer

In the ansible.cfg file.

Answer

In the role's vars/main.yml.

Question 5

Which two statements about ansible-vault are true? (Select exactly 2.)

Accepted Answer

Vault can encrypt entire files or individual variables.. Ansible-vault can encrypt either entire files (e.g., vars files, role defaults) or individual variables within a YAML file using the `!vault` tag. This flexibility allows you to protect sensitive data at the granularity you choose, without requiring separate encrypted files for each secret.

Answer

Vault-encrypted files cannot be used with include_vars.

Answer

Vault uses AES-128 encryption by default.

Answer

Vault passwords can be stored directly in ansible.cfg.

Question 6

Refer to the exhibit. An Ansible playbook contains the following block structure. If the task inside the block fails, which of the following describes the execution order of the rescue and always sections?

Accepted Answer

Rescue runs, then always.. In Ansible, when a task inside a block fails, the rescue section executes to handle the failure, and then the always section runs unconditionally. This ensures that cleanup or finalization tasks are performed regardless of success or failure. Therefore, the correct execution order is rescue first, then always.

Answer

Only always runs.

Answer

Only rescue runs.

Answer

Always runs, then rescue.

Question 7

A company has a large infrastructure with over 1000 servers. They run a playbook that configures NTP on all servers. The playbook takes over 30 minutes due to sequential execution. The team wants to reduce execution time. Which approach should they take?

Accepted Answer

Set forks: 50 and strategy: free.. Increasing forks and using free strategy maximizes parallelism. Option A (serial) still processes batches sequentially. Option C (ansible-pull) shifts the workload but may not be faster. Option D (include_tasks) does not affect parallelism.

Answer

Use serial: 10 to batch hosts.

Answer

Use include_tasks to parallelize tasks.

Answer

Use ansible-pull on each server.

Question 8

A new technician runs a playbook that uses the yum module to install packages. The playbook fails with 'No package matching' for a custom package. The package is available on a third-party repository. Which step should the technician take?

Accepted Answer

Add the repository using the yum_repository module.. The yum module requires that the repository providing the package is already configured on the target system. Since the custom package is on a third-party repository, the technician must first add that repository using the yum_repository module. This module creates the necessary .repo file in /etc/yum.repos.d/, making the package available for installation via the yum module.

Answer

Use the rpm_key module to import the GPG key.

Answer

Use command: yum install directly.

Answer

Update the package cache using yum update.

Question 9

An administrator needs to apply a set of firewall rules to multiple servers. They have created a playbook that uses the firewalld module. When running the playbook, they receive 'ERROR! module not found: firewalld'. The control node has the module available locally. What is the most likely cause?

Accepted Answer

The ansible.posix collection is not installed on the control node.. Error 'module not found: firewalld' indicates the module is not accessible. The firewalld module belongs to the ansible.posix collection, which must be installed on the control node (e.g., via 'ansible-galaxy collection install ansible.posix'). Option B is correct because the missing collection is the most likely cause. Option A is incorrect because 'firewalld' is the valid module name. Option C is possible but less likely than a missing collection. Option D is incorrect because modules execute on the control node, not target nodes.

Answer

The playbook uses the wrong module name.

Answer

The ansible.cfg has a wrong module path.

Answer

The module is not installed on the target nodes.

Question 10

A playbook must execute cleanup tasks after a block of tasks, both on success and failure. Which two of the following should be used within the block to achieve this?

Accepted Answer

always. To execute cleanup tasks after a block regardless of success or failure, use the block keyword to group the main tasks and the always keyword to define tasks that run unconditionally. The block + always pattern ensures cleanup runs even if the block fails. The other options do not achieve this: ignore_errors only prevents failures from stopping execution, rescue handles failures but only after a failure, and failed_when customizes failure conditions but does not guarantee cleanup execution.

Answer

ignore_errors

Answer

rescue

Answer

failed_when

Question 11

An organization uses Ansible to manage an AWS EC2 environment. The Ansible control node runs on a Linux server, and the team uses a dynamic inventory script (ec2.py) to automatically populate hosts. Recently, they need to run a playbook only against EC2 instances that have a specific tag, 'Environment', set to 'production'. The team has placed the ec2.ini configuration file in the same directory as the inventory script. However, when they run the playbook with '-i ec2.py', the playbook runs against all instances instead of only production ones. The team verifies that the tag exists on the correct instances and that the environment variable AWS_PROFILE is set correctly. Which action should resolve the issue?

Accepted Answer

Modify the ec2.ini file to include 'filters = tag:Environment=production' under the [ec2] section.. The ec2.py dynamic inventory script uses ec2.ini settings to filter instances. To filter by tags, the 'regions_exclude' and 'destination_variable' are set, but the 'filters' setting inside the 'ec2' section must be configured to include 'tag:Environment=production'. Option B correctly identifies that the ec2.ini must be modified with the 'filters' option. Option A is incorrect because 'hostname' is for naming hosts, not filtering. Option C would not filter by the tag. Option D is unrelated.

Answer

Set the environment variable 'EC2_TAGS=Environment=production' before running the playbook.

Answer

Use the '--limit' option with the playbook command to specify the tag.

Answer

Add the option 'hostname = tag_Name' to the ec2.ini file.

Question 12

A DevOps team is developing a collection of Ansible roles to standardize web server deployments. One role, 'webserver-base', configures the firewall and installs common packages. Another role, 'webserver-app', depends on 'webserver-base' and adds application-specific configurations. The team wants to ensure that when 'webserver-app' is applied to a host, 'webserver-base' is automatically applied first. They currently have a 'meta/main.yml' file in 'webserver-app' that lists 'webserver-base' as a dependency. However, when they run a playbook that includes 'webserver-app' in a role list, they notice that 'webserver-base' runs after 'webserver-app' sometimes, causing configuration conflicts. They verify that the dependency is correctly defined and that no other roles are involved. What change should they make to ensure 'webserver-base' always runs before 'webserver-app'?

Accepted Answer

Set 'static: yes' in the dependency entry in the dependent role's meta/main.yml.. By default, role dependencies are executed before the dependent role. However, when roles are included dynamically (e.g., via `include_role`), the order may not be guaranteed. Setting `static: yes` in the dependency entry in `meta/main.yml` forces Ansible to statically inline the dependency at playbook parse time, ensuring that `webserver-base` always runs before `webserver-app`. Option B is correct because it directly addresses the ordering issue by making the dependency static. Option A is incorrect because `include_role` is a dynamic inclusion module, not a dependency type. Option C is incorrect because `order` is not a valid attribute for dependencies. Option D is a playbook-level workaround but does not enforce the dependency when the role is used elsewhere.

Answer

Change the dependency type to 'include_role' in the playbook to control ordering.

Answer

Add 'order: before' to the dependency entry in meta/main.yml.

Answer

Add a 'pre_tasks' section in the playbook to include 'webserver-base' before 'webserver-app'.

Question 13

An organization uses Ansible Tower to manage automation across different teams. One team has a job template that uses a custom Python virtual environment located at '/opt/custom_venv' to run a playbook that uses the 'docker_container' module from the 'community.docker' collection. The playbook runs successfully from the command line when using the '--ask-become-pass' option and the virtual environment activated. However, when the team runs the same playbook via the Ansible Tower job template, it fails with an error indicating that the 'docker_container' module is not found. The job template is configured to use the custom virtual environment under the 'CUSTOM VIRTUAL ENVIRONMENT' setting. The team confirms that the virtual environment has the collection installed (verified by running 'ansible-galaxy collection list' inside the venv). What is the most likely cause of the failure?

Accepted Answer

The Ansible Tower node executing the job does not have the custom virtual environment installed.. The most likely cause is that the Ansible Tower node executing the job does not have the custom virtual environment installed (Option B). Even though the job template is configured to use the custom virtual environment at '/opt/custom_venv', Tower runs jobs on its own execution nodes (or the node specified in the job template's execution environment). If that node does not have the custom virtual environment installed, it will fail to find the 'community.docker' collection. Option A is incorrect because 'ansible_connection: local' does not affect collection availability. Option C is incorrect because the team verified the collection is installed in the custom venv. Option D is incorrect because the question states the job template uses the correct path; the failure is due to the node lacking the venv entirely.

Answer

The playbook should use the 'ansible_connection: local' directive to force local execution.

Answer

The 'community.docker' collection was installed in the default system-wide location instead of the custom virtual environment.

Answer

The job template's 'CUSTOM VIRTUAL ENVIRONMENT' setting points to a different path than '/opt/custom_venv'.

Question 14

A company uses Ansible Vault to encrypt sensitive data in playbooks. They have multiple environments (dev, test, prod) and use a separate vault password file for each environment. The passwords are stored in files named 'vault-pass-dev', 'vault-pass-test', and 'vault-pass-prod'. To run a playbook against the test environment, they use the command 'ansible-playbook site.yml -i test -e @test-vars.yml --vault-id test@vault-pass-test'. This runs successfully from the command line. However, when they define the same vault-id in an Ansible Tower credential and attempt to run the job, the job fails with 'ERROR! Decryption failed (no vault secrets would be found that could decrypt the vault encrypted file)' for a vault-encrypted variable file that was encrypted with a different vault ID (e.g., 'dev'). The team expects that Tower would use the provided vault credential to decrypt all vault-encrypted files. Which change should be made to ensure correct decryption in Tower?

Accepted Answer

Add multiple vault credentials to the job template, one for each vault ID used in the project.. In Ansible Tower, each vault credential is associated with a single vault ID. When a playbook uses multiple vault IDs (e.g., dev, test, prod), Tower must have a vault credential for each ID to decrypt files encrypted with that ID. By adding multiple vault credentials to the job template—one for each vault ID used in the project—Tower can automatically select the correct credential for decryption, resolving the failure. Option A is correct because it provides Tower with all necessary vault IDs. Option B is wrong because Tower does not support comma-separated passwords in a single credential. Option C would simplify but is not a configuration change. Option D is incorrect because the password file already contains the correct password for the test vault ID, but the encrypted file uses the dev vault ID.

Answer

Enter all vault passwords separated by commas in the 'VAULT PASSWORD' field of a single credential.

Answer

Re-encrypt all files with the same vault ID (e.g., 'default') to simplify the setup.

Answer

Change the vault password file to contain the password for the vault ID that was used to encrypt the file.

Question 15

An Ansible inventory file includes a group [webservers] containing web1. Another group [all] contains web1 and web2. When running a playbook with --limit webservers, the playbook fails on web2. Why does this happen?

Accepted Answer

The 'webservers' group includes web2 due to a misconfiguration.. The inventory file does not list web2 under the 'webservers' group; only web1 is listed. However, when running the playbook with --limit webservers, web2 is still targeted. This indicates a misconfiguration, such as a duplicate host entry, incorrect group assignment, or a faulty inventory script that inadvertently includes web2 in the webservers group. Ansible's --limit option restricts execution to hosts that are members of the specified group, so if web2 is not supposed to be in webservers but appears due to error, the playbook fails on web2 because it is unreachable or misconfigured for that role.

Answer

The SSH key for web2 is not authorized.

Answer

The inventory file has a syntax error causing web2 to be included in webservers.

Answer

The playbook's 'hosts' directive is set to 'all' instead of 'webservers'.