EX294 Implement advanced Ansible automation Practice Test 8 — 15 Questions

Question 1

A company has a large infrastructure with over 1000 servers. They run a playbook that configures NTP on all servers. The playbook takes over 30 minutes due to sequential execution. The team wants to reduce execution time. Which approach should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set forks: 50 and strategy: free.. Ansible's default forks value is 5, meaning only five hosts are configured concurrently, which explains the 30-minute runtime across 1000 servers. Raising forks to 50 increases parallelism, and the free strategy lets each host proceed through tasks independently without waiting for all hosts to finish each task, further reducing wall-clock time.

Answer

Use serial: 10 to batch hosts.

Answer

Use include_tasks to parallelize tasks.

Answer

Use ansible-pull on each server.

Question 2

A new technician runs a playbook that uses the yum module to install packages. The playbook fails with 'No package matching' for a custom package. The package is available on a third-party repository. Which step should the technician take?

Accepted Answer

Add the repository using the yum_repository module.. The yum module requires that the repository providing the package is already configured on the target system. Since the custom package is on a third-party repository, the technician must first add that repository using the yum_repository module. This module creates the necessary .repo file in /etc/yum.repos.d/, making the package available for installation via the yum module.

Answer

Use the rpm_key module to import the GPG key.

Answer

Use command: yum install directly.

Answer

Update the package cache using yum update.

Question 3

A company uses Ansible Vault to encrypt sensitive data in playbooks. They have multiple environments (dev, test, prod) and use a separate vault password file for each environment. The passwords are stored in files named 'vault-pass-dev', 'vault-pass-test', and 'vault-pass-prod'. To run a playbook against the test environment, they use the command 'ansible-playbook site.yml -i test -e @test-vars.yml --vault-id test@vault-pass-test'. This runs successfully from the command line. However, when they define the same vault-id in an Ansible Tower credential and attempt to run the job, the job fails with 'ERROR! Decryption failed (no vault secrets would be found that could decrypt the vault encrypted file)' for a vault-encrypted variable file that was encrypted with a different vault ID (e.g., 'dev'). The team expects that Tower would use the provided vault credential to decrypt all vault-encrypted files. Which change should be made to ensure correct decryption in Tower?

Accepted Answer

Add multiple vault credentials to the job template, one for each vault ID used in the project.. In Ansible Tower, each vault credential is associated with a single vault ID and password. To decrypt files encrypted with different vault IDs, you must attach multiple vault credentials to the job template, each corresponding to a vault ID used in the project. This allows Tower to try each credential until decryption succeeds. The command-line success with a single vault-id works because only files encrypted with that ID are decrypted; files with other IDs would fail unless multiple --vault-id options are provided.

Answer

Enter all vault passwords separated by commas in the 'VAULT PASSWORD' field of a single credential.

Answer

Re-encrypt all files with the same vault ID (e.g., 'default') to simplify the setup.

Answer

Change the vault password file to contain the password for the vault ID that was used to encrypt the file.

Question 4

Refer to the exhibit. After the playbook run fails on the 'Verify config' task, what happens to the 'restart service' handler?

Accepted Answer

The handler is not executed because the playbook failed before the end of the play.. Handlers are notified but only run at the end of the play if notified. However, if a subsequent task fails, the playbook stops, and handlers are not executed unless the 'force_handlers' option is set.

Answer

The handler runs immediately after the failed task.

Answer

The handler runs on the next playbook run.

Answer

The handler is executed because it was notified before the failure.

Question 5

Refer to the exhibit. The playbook copies all .conf files from the control node to host1. If the playbook runs again on the same host without any changes, which task status is expected?

Accepted Answer

All items will show 'ok' because files are identical.. Ansible's `copy` module is idempotent: when the source and destination files are identical (same content and checksum), the module reports `ok` rather than `changed`. On a second run with no source changes, all items in the loop will show `ok` because Ansible compares checksums and determines no copy is needed. This is the core idempotency guarantee of Ansible modules.

Answer

The task will fail because the destination directory already contains files.

Answer

The task will be skipped because the files already exist.

Answer

All items will show 'changed'.

Question 6

Refer to the exhibit. The playbook fails because the httpd package is not found. Which is the most likely cause?

Accepted Answer

The target host does not have the necessary repositories enabled.. The error indicates the package is not available. This is typically due to missing or incorrect repository configuration. The playbook itself and role syntax are valid.

Answer

The inventory does not define 'webservers' group.

Answer

The role path is incorrectly configured in ansible.cfg.

Answer

The 'yum' module should use 'name=httpd' instead of YAML syntax.

Question 7

Refer to the exhibit. The playbook fails with an error about the package list. What is the issue?

Accepted Answer

The variable 'packages' is being converted to a string by the Jinja2 template, resulting in a list literal string.. The yum module expects a list of strings or a comma-separated string. The variable 'packages' is a list, but when used with 'name: "{{ packages }}"', Jinja2 converts it to a string representation like "['httpd', 'mariadb-server', 'php']". The yum module does not accept that format; it needs a proper list or comma-separated string.

Answer

The variable 'packages' is not accessible because it is defined in a vars_file.

Answer

The 'yum' module requires the 'name' parameter to be a comma-separated string, not a list.

Answer

The 'yum' module should use 'pkg' instead of 'name'.

Question 8

An automation engineer must ensure that a task in a playbook runs only once across all hosts in the play, even though the play targets 50 web servers. The task creates a shared DNS record on an external service. Which approach should be used?

Accepted Answer

Add `run_once: true` to the task.. The `run_once` directive ensures that a task is executed only on the first host in the play, and the results are applied to all hosts. This is ideal for actions that should not be repeated per host, such as creating a shared resource. Other options either still execute per host or only control concurrency.

Answer

Set `serial: 1` on the play.

Answer

Use `delegate_to: localhost` on the task.

Answer

Add `throttle: 1` to the task.

Question 9

An administrator needs to run a playbook in check mode to preview changes on managed hosts, but a critical task using the `command` module must always execute regardless of check mode. Which task directive should be applied to that specific task?

Accepted Answer

`check_mode: no`. The `check_mode: no` task directive overrides the playbook-level check mode for that specific task, forcing it to execute normally even when `--check` is used. This is essential for tasks that must always run, such as those that gather facts or perform critical operations that should not be simulated.

Answer

`always_run: yes`

Answer

`ignore_errors: yes`

Answer

`run_once: true`

Question 10

An Ansible playbook uses a custom filter plugin located in the `filter_plugins/` directory next to the playbook. The filter is not being applied, and the playbook fails with an error that the filter is undefined. What is the most likely reason?

Accepted Answer

The filter plugin file must define a `FilterModule` class with a `filters` method.. Filter plugins require a specific structure: a `FilterModule` class with a `filters` method that returns a dictionary mapping filter names to functions. Without this, Ansible cannot register the filter, leading to an undefined filter error. The directory location and file extension are correct, so the structure is the likely culprit.

Answer

The filter plugin must be written in Python and have a `.py` extension.

Answer

The `filter_plugins` directory must be specified in `ansible.cfg` using `filter_plugins = ./filter_plugins`.

Answer

The filter plugin must be placed in a `library` directory instead of `filter_plugins`.

Question 11

A playbook uses a variable named `db_port` that must be defined by the user at runtime, but should fall back to 5432 if the user does not provide it. Which approach ensures this behavior without failing the play when the variable is undefined?

Accepted Answer

Use the `default` filter: `{{ db_port | default(5432) }}`.. The `default` filter is the correct mechanism because it supplies a fallback only when the variable is undefined, allowing user-provided values to take precedence. It avoids interactive prompts and precedence conflicts, and it works in any templated context. The other options either force a value, require interaction, or fail to provide a value at all.

Answer

Define `db_port` in `group_vars/all.yml` with a value of 5432.

Answer

Reference `db_port` directly and set `ignore_errors: true` on the task.

Answer

Use `vars_prompt` to ask for `db_port` with a `default` keyword set to 5432.

Question 12

A playbook uses a task with 'delegate_to: localhost' to generate a report file. The task must run only once, even if the play targets multiple hosts. Which keyword should be added to the task to ensure it executes only on the first host?

Accepted Answer

run_once: true. The run_once keyword ensures the task is executed only on the first host in the play, regardless of how many hosts are targeted. When combined with delegate_to: localhost, the task runs once on the control node, generating a single report. Other keywords like serial, throttle, or any_errors_fatal affect batching, concurrency, or error handling, not single execution.

Answer

throttle: 1

Answer

any_errors_fatal: true

Answer

serial: 1

Question 13

A playbook includes a role that has a task notifying a handler defined within the role. Another task in the play, outside the role, also notifies the same handler by name. After running the playbook, the administrator notices that the handler runs only once. What is the reason for this behavior?

Accepted Answer

Handlers are executed only once per play, even if notified multiple times.. Handlers in Ansible are run once per play at the end, even if notified multiple times. This is by design to avoid multiple restarts of a service. The handler's scope is not limited to the role; it can be notified from anywhere in the play. The correct explanation is that handlers are deduplicated and executed once.

Answer

Handlers are executed immediately when notified, so the first notification triggers it and the second is ignored.

Answer

The handler runs only if the notifying task reports a changed status, and both tasks reported 'ok'.

Answer

The handler is scoped to the role and cannot be notified from outside the role.

Question 14

An automation engineer is using Ansible to manage a fleet of servers. They need to ensure that certain tasks run only on hosts that match specific criteria. Which two of the following are valid ways to limit task execution based on host facts? (Choose two.)

Accepted Answer

Use the 'group_by' module to create dynamic groups based on facts, then target those groups in subsequent plays.. The 'when' conditional and the 'group_by' module are both valid methods to limit task execution based on host facts. The 'when' clause evaluates facts per host, while 'group_by' dynamically creates groups that can be targeted in subsequent plays. Tags, delegate_to, and run_once do not provide fact-based filtering of hosts.

Answer

Use the 'tags' keyword to tag tasks with fact values, then run the playbook with --tags to filter.

Answer

Use the 'delegate_to' directive with a fact-based expression to delegate tasks to matching hosts.

Answer

Use the 'run_once' keyword with a fact-based condition to run the task only on the first matching host.

Question 15

A playbook must execute a task on a host that is not part of the inventory, such as a temporary cloud instance. The task should run on that host without modifying the inventory file. Which directive should be used?

Accepted Answer

add_host. The add_host module is designed to add hosts to the in-memory inventory at runtime, enabling tasks to run on hosts not present in the static inventory. Other directives like delegate_to, local_action, and include_vars serve different purposes and do not add hosts.

Answer

local_action

Answer

delegate_to

Answer

include_vars