EX294 Implement advanced Ansible automation Practice Test 7 — 15 Questions

Question 1

A playbook uses the copy module to deploy a configuration file. The file should be templated with variables, but the engineer mistakenly uses the 'src' parameter with a static file instead of 'content' or a template module. What is the most likely outcome?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file is copied without variable substitution, resulting in literal Jinja2 syntax in the destination.. The copy module with the 'src' parameter copies a file without any processing of Jinja2 templates. It does not perform variable substitution. Therefore, if the source file contains Jinja2 syntax (e.g., {{ variable }}), it will be copied literally to the destination. The correct answer is B. Option A is incorrect because the copy module does not automatically render templates. Option C is incorrect because the playbook will not fail due to undefined variables; it simply copies the file as-is. Option D is incorrect because the task will execute and copy the file, not skip.

Answer

The module automatically renders the Jinja2 template before copying.

Answer

The playbook fails because the source file contains undefined variables.

Answer

The task is skipped because copy cannot handle variables.

Question 2

An organization uses separate network hops that require different SSH usernames for different inventory groups. Which Ansible configuration approach ensures each group uses the correct SSH user without duplicating playbooks?

Accepted Answer

Create a group_vars directory with a file named after the group containing ansible_user.. Group variables in Ansible are defined in group_vars/<group_name>.yml, and variables set there apply to all hosts in that group. Placing ansible_user in a group-specific file ensures each inventory group uses its correct SSH username without duplicating playbook logic. This is the idiomatic Ansible way to scope connection variables per group.

Answer

Specify the SSH user in the inventory file for each host.

Answer

Set the ansible_user variable in ansible.cfg.

Answer

Define ansible_user in the playbook using vars.

Question 3

A playbook uses a loop over a list of packages to ensure they are installed. However, the playbook runs slowly because each package is processed individually. Which optimization technique should be used to improve performance?

Accepted Answer

Pass the entire list to the package module's 'name' parameter instead of looping.. Ansible's package modules (such as yum, apt, or dnf) accept a list of packages in the 'name' parameter. Passing the entire list in a single task eliminates the overhead of multiple task executions, SSH connection reuse, and module setup/teardown that occur with each iteration in a loop. This reduces the number of Ansible task runs from N to 1, significantly improving performance.

Answer

Use with_items instead of loop; with_items is faster.

Answer

Set the async parameter on the looped task to run packages in parallel.

Answer

Use the serial keyword at the play level to increase parallelism.

Question 4

An administrator needs to securely store a database password used across multiple roles in a shared repository. Which approach is recommended?

Accepted Answer

Use ansible-vault to encrypt the password string and store it in a file, then include_vars.. Ansible-vault encrypts sensitive data at rest using AES-256, and the encrypted file can be safely stored in a shared repository. The `include_vars` module then decrypts the file at runtime when the vault password is provided, allowing multiple roles to access the password without exposing it in plaintext.

Answer

Use a lookup plugin to fetch from a secrets manager.

Answer

Store the password in an environment variable on the controller.

Answer

Hardcode the password in the playbook and use .gitignore.

Question 5

A playbook uses import_playbook to include other playbooks. The main playbook is run with --check mode. Which statement is true?

Accepted Answer

Imported playbooks are also run in check mode.. When a playbook uses `import_playbook`, the imported playbooks are statically included at parse time, meaning they become part of the main playbook's play structure. The `--check` mode flag applies to the entire playbook execution, so all imported playbooks also run in check mode. Option D is correct because Ansible propagates the check mode flag to all imported plays.

Answer

Only the main playbook runs in check mode; imported ones run normally.

Answer

All imported playbooks are skipped because import happens at parse time.

Answer

import_playbook does not support check mode.

Question 6

A company uses dynamic inventory from a cloud provider. The playbook needs to run tasks only on instances with a specific tag. The ansible_ec2_tags variable is not available. What is the most efficient method to filter hosts?

Accepted Answer

Use the amazon.aws.aws_ec2 inventory plugin with compose and keyed_groups.. The `amazon.aws.aws_ec2` inventory plugin can dynamically filter EC2 instances by tag using `keyed_groups` and `compose` at inventory build time, avoiding runtime overhead. This is the most efficient method as it pre-filters hosts before the playbook runs, unlike runtime fact gathering or lookups.

Answer

Use the hostvars lookup to check tags.

Answer

Use the ec2_instance_facts module inside the playbook to gather facts and filter.

Answer

Use a static inventory file with hosts pre-filtered.

Question 7

An organization has a set of common tasks used in many playbooks. The tasks are updated frequently. What is the most maintainable way to share them?

Accepted Answer

Package the tasks into a collection and install it via ansible-galaxy.. Ansible Collections provide a centralized, versioned, and distributable way to package and share tasks, roles, modules, and plugins. Using `ansible-galaxy collection install` allows teams to manage updates from a single source (e.g., Automation Hub or a private Galaxy server), ensuring all playbooks use the latest version without manual file copying or path dependencies.

Answer

Create a role and store it in a local directory referenced by ansible.cfg.

Answer

Copy the task files into each project repository.

Answer

Use include_tasks with a relative path from each playbook.

Question 8

A playbook uses serial: 2 and sets any_errors_fatal: true. The first batch of 2 hosts both fail. What happens?

Accepted Answer

The playbook aborts and no further batches run.. When `any_errors_fatal: true` is set and a batch of hosts fails, Ansible immediately aborts the entire playbook run for all remaining hosts, regardless of the `serial` setting. Since the first batch of 2 hosts both fail, no further batches are executed. This behavior is designed to prevent cascading failures in critical deployments.

Answer

The playbook continues with the next batch.

Answer

The playbook marks the batch as unreachable and continues.

Answer

The playbook retries the failed hosts.

Question 9

A playbook uses an Ansible collection that includes a custom module. The module's documentation is missing. What is the best way to locate the module's source code?

Accepted Answer

Navigate to the collection's plugin directory on the control node.. Ansible collections store custom modules in the 'plugins/modules' directory within the collection's installation path on the control node. Navigating to that directory allows you to view the module's source code directly, which is the most reliable way to locate it when documentation is missing.

Answer

Run ansible-doc <module name>.

Answer

Search the Ansible Galaxy website.

Answer

Look in the roles directory.

Question 10

An administrator wants to run a playbook with a different user for a specific host. Which variable should be set?

Accepted Answer

ansible_user. Ansible_user sets the remote user for SSH connections to the target host. Option B (ansible_user_id) is a fact variable that returns the UID of the user running the task on the remote host, not the connection user. Option C (ansible_ssh_user) is a deprecated alias for ansible_user. Option D (ansible_remote_user) is also a deprecated alias.

Answer

ansible_user_id

Answer

ansible_ssh_user

Answer

ansible_remote_user

Question 11

A playbook uses the 'block' and 'rescue' keywords. If a task in the block fails, but the rescue tasks also fail, what happens?

Accepted Answer

The play fails.. When a task in a block fails, the rescue tasks execute. If the rescue tasks also fail, the entire play fails (the failure propagates). Option B is incorrect because the play does not continue; it fails. Option C is incorrect because the block is not re-executed; rescue only runs once. Option D is incorrect because rescue tasks are not retried after failure.

Answer

The play continues to the next task.

Answer

The block is re-executed.

Answer

The rescue tasks are retried.

Question 12

Which two statements about Ansible roles are correct? (Select exactly 2.)

Accepted Answer

Roles can include tasks, handlers, variables, and defaults.. Option C is correct because an Ansible role is a structured directory layout that can bundle tasks (tasks/main.yml), handlers (handlers/main.yml), variables (vars/main.yml), and defaults (defaults/main.yml) along with files, templates, and meta, allowing reusable automation content. Option E is correct because roles can be installed from Ansible Galaxy using the ansible-galaxy role install command (e.g., ansible-galaxy install geerlingguy.nginx), which fetches roles from Galaxy or a configured requirements file. Option A is not required: meta/main.yml is optional and only needed when declaring role dependencies or Galaxy metadata. Option B is inaccurate because a role is a reusable content structure invoked by a playbook via roles or include_role/import_role, not itself a playbook. Option D is false because include_role is specifically used to dynamically include roles at runtime.

Answer

Roles must have a meta/main.yml file.

Answer

Roles are a type of playbook.

Answer

Roles cannot be used with include_role.

Question 13

Which three methods can be used to pass variables to an Ansible playbook? (Select exactly 3.)

Accepted Answer

In the playbook's vars_files directive.. The `vars_files` directive in a playbook allows you to specify external YAML or JSON files containing variables, which are then merged into the play's variable scope at runtime. This is a standard method for passing variables to a playbook, as it separates variable definitions from the playbook logic.

Answer

In the ansible.cfg file.

Answer

In the role's vars/main.yml.

Question 14

Which two statements about ansible-vault are true? (Select exactly 2.)

Accepted Answer

Vault can encrypt entire files or individual variables.. Ansible-vault can encrypt either entire files (e.g., vars files, role defaults) or individual variables within a YAML file using the `!vault` tag. This flexibility allows you to protect sensitive data at the granularity you choose, without requiring separate encrypted files for each secret.

Answer

Vault-encrypted files cannot be used with include_vars.

Answer

Vault uses AES-128 encryption by default.

Answer

Vault passwords can be stored directly in ansible.cfg.

Question 15

Refer to the exhibit. An Ansible playbook contains the following block structure. If the task inside the block fails, which of the following describes the execution order of the rescue and always sections?

Accepted Answer

Rescue runs, then always.. In Ansible, when a task inside a block fails, the rescue section executes to handle the failure, and then the always section runs unconditionally. This ensures that cleanup or finalization tasks are performed regardless of success or failure. Therefore, the correct execution order is rescue first, then always.

Answer

Only always runs.

Answer

Only rescue runs.

Answer

Always runs, then rescue.