EX294 Manage automation security and operations Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. An automation job failed with the given error. What is the most likely cause?

Accepted Answer

The SSH key is not authorized for the remote user. The error message indicates an SSH authentication failure, which occurs when the SSH key presented by the control node is not authorized for the remote user's account. This is the most likely cause because Ansible relies on SSH key-based authentication by default, and a missing or mismatched public key on the remote host will prevent the connection.

Answer

The playbook syntax is incorrect

Answer

The SSH port is blocked

Answer

The remote host is unreachable

Question 2

Which two conditions could prevent an automation controller job from starting? (Choose two.)

Accepted Answer

The project sync is pending. Option B is correct because a job template that references a project whose sync is still pending cannot launch — the controller must have a successfully synced project revision before it can start the job, so a pending project sync blocks the start. Option C is correct because a job template that has been disabled will not launch; the controller refuses to start jobs from disabled templates until they are re-enabled. Option A is not correct because an empty inventory source does not prevent a job from starting — the job can still run (often failing at playbook execution or with no hosts matched) rather than being blocked from starting. Option D is not correct because the system auditor role is a read-only role; it affects what a user can view or launch based on permissions, but being a system auditor by itself is not a condition that prevents a job from starting. Option E is not correct because using the 'latest' image tag for an execution environment is valid and does not block job startup, even though pinning a specific tag is a best practice.

Answer

The inventory source is empty

Answer

The user is a system auditor

Answer

The execution environment image tag is 'latest'

Question 3

A systems administrator needs to securely store a database password for use in an Ansible playbook. The password should be encrypted at rest and decrypted only at runtime when the playbook is executed. Which approach should the administrator take?

Accepted Answer

Use the ansible-vault encrypt_string command to encrypt the password and store it in a variables file.. `ansible-vault encrypt_string` encrypts the password at rest using AES-256, storing it as a ciphertext string in a variables file. At runtime, when the playbook is executed with `--ask-vault-pass` or a vault password file, Ansible decrypts the value transparently, ensuring the plaintext password is never written to disk or logs.

Answer

Store the password as a plain text variable in the playbook and use the no_log: yes directive to prevent logging.

Answer

Store the password in an unprotected external file and reference it with include_vars.

Answer

Save the password in an environment variable and access it via lookup('env','DB_PASS').

Question 4

An administrator is configuring a job template in automation controller that runs a playbook to deploy a web application. The playbook requires a database password that changes quarterly. To avoid updating the credential each quarter, what is the best approach to dynamically provide the password without exposing it in the playbook?

Accepted Answer

Define a survey prompt in the job template that asks for the password during launch.. A survey prompt in the job template allows the password to be entered at launch time, avoiding hardcoding or storing it in the playbook or project. This approach dynamically provides the password each quarter without requiring credential updates, as the survey can be configured to prompt for the password as a variable that the playbook uses. It aligns with automation controller's built-in survey feature for secure, runtime variable input.

Answer

Use a lookup plugin to fetch the password from an external secrets manager.

Answer

Store the password as a variable in the project repository and encrypt it with ansible-vault.

Answer

Create a custom credential type that prompts for the password each launch.

Question 5

A workflow template in automation controller consists of three job templates that must run sequentially with different credentials. The first job template uses a machine credential to provision a VM, the second uses a network credential to configure the switch, and the third uses a cloud credential to deploy the application. To secure the credential usage, what should the administrator configure?

Accepted Answer

Set each job template to use the appropriate credential and ensure workflow node permissions are set to 'use credential'.. To secure credential usage in a workflow with multiple job templates requiring different credentials, each job template should be configured with its appropriate credential, and workflow node permissions should be set to 'use credential'. This ensures that each job runs with only the necessary credentials, adhering to least privilege.

Answer

Create a single credential that covers all three environments.

Answer

Define credential validation rules in the workflow node properties.

Answer

Assign all three credentials to the workflow template directly.

Question 6

An organization uses a proprietary API service that requires token-based authentication with a base64-encoded payload including username, password, and tenant ID. The administrator wants to create a custom credential type in automation controller so that users can input these three values separately, and the playbook receives the final token. Which input configuration fields should be defined?

Accepted Answer

Three separate text fields (username, password, tenant ID) with a custom injector template that concatenates and base64-encodes them.. Automation controller custom credential types allow defining multiple input fields (username, password, tenant ID) and a custom injector template that can concatenate and base64-encode these values into a single token. The injector template uses Jinja2 syntax to combine the inputs and apply the `b64encode` filter, so the playbook receives the final base64-encoded token as a single credential variable.

Answer

One text field for the token, and inject it as an environment variable.

Answer

Two fields: username and password, and use a lookup plugin to fetch tenant ID.

Answer

Create a single multiline text field where users paste the base64 string.

Question 7

An automation controller administrator needs to limit access to a sensitive inventory. Which two methods can be used to restrict access to that inventory? (Choose two.)

Accepted Answer

Place the inventory in an organization and assign appropriate roles to users and teams.. Option B is correct because in automation controller (Ansible Automation Platform), inventories belong to an organization, and access is controlled through role-based access control (RBAC) by assigning roles such as Inventory Admin, Inventory Update, or Inventory Ad Hoc on the inventory to specific users or teams within that organization. Option C is correct because automation controller supports custom roles, allowing an administrator to define a role with only read (view) permissions on the inventory and grant it to the users who should have limited access, thereby restricting what they can do with the sensitive inventory. Option A is incorrect because 'admin' is a built-in system role, not a role that is assigned to an inventory to limit access; granting admin would broaden privileges rather than restrict them. Option D is incorrect because ansible-vault encrypts inventory files at rest but does not control access within automation controller's RBAC model, and it is not a supported method for restricting inventory access in the controller. Option E is incorrect because automation controller does not provide a 'private' inventory setting to restrict access; access is governed by organizations and RBAC roles.

Answer

Assign the 'admin' role to the inventory and grant it only to specific users.

Answer

Encrypt the inventory with ansible-vault and share the vault password only with authorized users.

Answer

Set the inventory to 'private' in the inventory settings.

Question 8

An organization uses automation controller with multiple projects and teams. They want to enforce that only the operations team can run job templates that make changes in production, while the development team can only run job templates that deploy to development environments. Which three components should be configured to achieve this? (Choose three.)

Accepted Answer

Assign different credentials to each job template.. Option B is correct because separate job templates for production and development are the foundation for distinguishing which automation can be run against each environment, allowing RBAC to be applied per template. Option C is correct because automation controller uses role-based access control, and defining team roles (such as execute or admin) on each job template is exactly how you grant the operations team permission to run production templates while restricting the development team to development templates. Option A is correct because credentials are a separate access-controlled object; assigning distinct credentials to each job template ensures that even if a user can see a template, they can only run it with credentials they are permitted to use, reinforcing the production/development separation. Option D is not needed because execution environments define the containerized runtime (Ansible version, collections, dependencies) and are not a team-scoped authorization mechanism. Option E is not needed because a workflow template orchestrates multiple job templates and does not itself enforce which team may launch a given job template; role assignments on the job templates do that.

Answer

Set execution environments to be team-specific.

Answer

Use a workflow template that routes based on user role.

Question 9

A company has deployed Ansible Automation Platform with a single automation controller node. The operations team uses a workflow that includes three job templates: A, B, and C, each requiring different credentials. Recently, the workflow started failing intermittently with errors such as 'Timeout' and 'Connection refused' on certain hosts. The inventory is dynamic from a cloud provider. The administrator checks that the credentials are valid and the hosts are online. The job execution history shows that the failures occur only when the workflow attempts to run job template B on a subset of hosts that are located in a different subnet. Job templates A and C run fine on all hosts. What is the most likely cause and the best course of action?

Accepted Answer

The hosts in the problematic subnet are not reachable due to a firewall; add those hosts to a separate inventory and use a different cloud credential.. The errors 'Connection refused' and 'Timeout' on a subset of hosts for only one job template suggest a network‑level issue specific to that template’s communication path. A firewall rule blocking the port or IP used by job template B (potentially a non‑default SSH port or a different route due to its credential) is the most likely cause. Adding the affected hosts to a separate inventory with a different cloud credential can force Ansible to use an alternative network path or gateways, bypassing the restriction. Simply installing a second controller node does not explain why templates A and C succeed on the same hosts.

Answer

The credential used by job template B is associated with an incorrect SSH key for those hosts; create a new credential for that subnet and update the job template.

Answer

The automation controller does not have network access to the problematic subnet; install a second automation controller node in that subnet and configure clustering.

Answer

The job template B requires a sudo escalation that is not configured on those hosts; update the playbook to use become_method: su.

Question 10

A large enterprise runs a multi-tenant Ansible Automation Platform deployment. The security team has mandated strict role-based access control (RBAC) for three departments: Network (manages routers/switches), Security (manages firewalls/IDS), and Operations (manages servers/applications). Each department must have its own projects, inventories, job templates, and credentials. Additionally, credentials must not be viewable by users who do not own them. The platform currently uses a single organization with one team and all users have admin permissions. Which course of action best meets these requirements?

Accepted Answer

Create three organizations (Network, Security, Operations). Within each organization, create a team, assign users, and grant appropriate permissions. Use custom roles to restrict credential access to team members only.. Creating separate organizations for each department provides the strongest isolation boundary in Ansible Automation Platform. Within each organization, a dedicated team with custom roles ensures that credentials are scoped to that team and cannot be viewed by users outside it, satisfying the RBAC and credential visibility requirements.

Answer

Create custom roles with no organizations. Assign users directly to resources via user-level permissions.

Answer

Keep a single organization but create three teams. Assign each team to its own projects and inventories, and use job template-level permissions to restrict access.

Answer

Use a single organization with one team. Set all credentials to 'read-only' to prevent viewing of secret values.

Question 11

Which TWO are valid ways to restrict access to job templates in Automation Controller?

Accepted Answer

Use credential types with separate permissions. Credential types in Automation Controller can be configured with their own permissions, allowing you to restrict which users or teams can use specific credentials. Since job templates require credentials to run, controlling access to credentials indirectly restricts access to the job templates that depend on them. This is a key aspect of role-based access control (RBAC) in Automation Controller.

Answer

Use tags in playbooks

Answer

Set job template to 'run at specific times'

Answer

Use inventory source filters

Question 12

Refer to the exhibit. A playbook fails with the above error when using ansible-vault. What is the most likely cause?

Accepted Answer

The vault id used in the playbook does not match the one used to encrypt the file.. The error indicates a vault ID mismatch. When a file is encrypted with a specific vault ID (e.g., `--vault-id prod@prompt`), the playbook must use the same vault ID to decrypt it. If the vault ID used in the playbook (via `--vault-id` or `ansible-vault` command) does not match the one used during encryption, Ansible will fail with a decryption error, even if the password is correct.

Answer

The file is not encrypted with ansible-vault.

Answer

The vault password file is missing.

Answer

The user does not have read permissions on the file.

Question 13

A systems administrator at a growing company uses Red Hat Ansible Automation Platform to manage configuration of web servers. They have a job template named 'Web Server Config' that runs a playbook to apply security hardening. The playbook includes variables encrypted with Ansible Vault using the default vault ID. The administrator has created a credential of type 'Ansible Vault Password' in Automation Controller and assigned it to the job template. When the job runs, it fails with the error: 'Decryption failed (no vault secrets would be found that would decrypt)'. However, other job templates that use the same vault credential run successfully. The administrator checks that the vault password is correct and that the credential is properly assigned. They also verify that the playbook's path is correct and the inventory is populated. What is the most likely cause of the failure?

Accepted Answer

The playbook references a different vault id than the one in the credential.. The error 'Decryption failed (no vault secrets would be found that would decrypt)' indicates that the vault password provided does not match the vault ID used to encrypt the variables. Since other job templates with the same credential work, the credential itself is valid. The most likely cause is that the playbook references a different vault ID than the one associated with the credential, causing decryption to fail.

Answer

The playbook has a syntax error.

Answer

The vault password file is missing from the controller.

Answer

The vault credential is not assigned to this specific job template.

Question 14

An operations team runs a playbook against production hosts and wants to prevent a mistyped variable from silently targeting the wrong inventory group. The playbook uses group_vars with a variable named app_port. A task must fail early if app_port is undefined. Which task-level keyword should be used?

Accepted Answer

assert with a that condition checking that app_port is defined.. The assert module is the standard way to validate preconditions in a playbook. A that expression such as app_port is defined fails the task with a clear message before any configuration runs, so a missing or misspelled variable cannot silently change target behavior. This is preferred over relying on incidental undefined-variable errors deeper in the play.

Answer

ignore_errors: false combined with a when clause on the task.

Answer

fail_when set to app_port is not defined on the task.

Answer

Set gather_facts: false and rely on the undefined variable error from the module.

Question 15

An automation controller administrator needs to allow a team to run a playbook that requires a privileged become password, but the password must not be stored in the project repository or visible in job output. Which controller feature should be used to supply the password?

Accepted Answer

Create a custom credential type that defines a become_password field and attach it to the job template.. A custom credential type lets you define a become_password field that the controller encrypts and injects at job runtime. This keeps the password out of the project repository and job output. Machine credentials are for SSH authentication, extra variables are not secret, and vault-encrypted files in the repository still violate the no-repository-secret rule.

Answer

Define the become password as an extra variable in the job template and mark it as secret.

Answer

Create a machine credential that includes the become password and attach it to the job template.

Answer

Store the become password in an Ansible Vault-encrypted file and commit it to the project repository.