EX294 Manage automation security and operations Practice Test 2 — 15 Questions

Question 1

A developer wants to encrypt a string in a playbook variable file. Which command should they use?

Accepted Answer

ansible-vault encrypt_string. `ansible-vault encrypt_string` is specifically designed to encrypt a single string value for use in a playbook variable file, without encrypting the entire file. This command outputs the encrypted string in a format that can be directly pasted into a YAML variable definition, preserving the rest of the file as plaintext.

Answer

ansible-vault rekey

Answer

ansible-vault create

Answer

ansible-vault edit

Question 2

An Ansible playbook is failing due to an undefined variable. Which approach would best help identify the source of the variable?

Accepted Answer

Add a debug task with var: hostvars[inventory_hostname]. Adding a debug task with `var: hostvars[inventory_hostname]` dumps all variables for the current host, including those inherited from group_vars, host_vars, and play-level vars. This allows you to inspect the full variable namespace and identify which variable is undefined or missing, directly addressing the root cause of the failure.

Answer

Add the 'ignore_errors: yes' directive

Answer

Set environment variable ANSIBLE_DEBUG=1

Answer

Use the --syntax-check flag

Question 3

A Red Hat Ansible Automation Platform installation uses a custom execution environment. The playbook runs fail with 'execution environment not found'. The execution environment is stored in a private registry requiring authentication. What must be configured?

Accepted Answer

Add the registry URL to the automation controller's container registry credentials. When an execution environment is stored in a private registry that requires authentication, the automation controller must have the registry's URL and credentials configured as a container registry credential. This credential is then used by the controller to authenticate and pull the execution environment image during job runs. Without this, the controller cannot access the private registry, resulting in the 'execution environment not found' error.

Answer

Set the execution_environment_image variable in the playbook

Answer

Configure the execution environment in the inventory

Answer

Add the registry to the project's source control

Question 4

An administrator needs to limit the number of concurrent jobs that can run on a specific automation controller node. Which setting should be adjusted?

Accepted Answer

The max concurrent jobs setting in the node's configuration. The correct setting to limit concurrent jobs on a specific automation controller node is the 'max concurrent jobs' parameter in the node's configuration. This setting directly controls how many jobs the node can execute simultaneously, preventing resource exhaustion and ensuring predictable performance. Adjusting this value is the proper method for managing node-level concurrency in Red Hat Ansible Automation Platform.

Answer

The forks parameter in the playbook

Answer

The job template's 'allow simultaneous' option

Answer

The number of execution environments

Question 5

A playbook using the 'uri' module is timing out when connecting to an external API. The network team confirms connectivity. What Ansible configuration parameter can be adjusted to increase the timeout?

Accepted Answer

ansible_timeout. `ansible_timeout` is an Ansible configuration parameter that controls the default socket-level timeout for network connections, including those made by the `uri` module. When an external API is slow to respond, increasing this value (default 10 seconds) allows the playbook to wait longer before aborting the connection attempt.

Answer

validate_certs

Answer

retries

Answer

delay

Question 6

A security team requires that all automation controller job logs be forwarded to an external SIEM system. Which integration should be used?

Accepted Answer

Automation controller's built-in logging aggregator. Automation controller (formerly Ansible Tower) includes a built-in logging aggregator that can forward job logs to external SIEM systems via supported protocols such as HTTPS, TCP, or UDP. This integration is configured directly in the controller's settings, requiring no additional scripts or system-level changes, making it the correct and supported method for centralized log forwarding.

Answer

Ansible Log Forwarder

Answer

Custom callback plugin

Answer

rsyslog configuration

Question 7

Refer to the exhibit. The user ran ansible-navigator without specifying an inventory. What does the warning indicate about the target hosts?

Accepted Answer

The playbook only ran against localhost because no inventory was defined. When `ansible-navigator` runs without a specified inventory, it defaults to using the implicit localhost. The implicit localhost is automatically part of the `all` group, so a playbook with `hosts: all` will match localhost and execute tasks on it. The warning indicates that no inventory was provided, meaning only localhost is available as a target host. Therefore, the playbook ran only against localhost, which corresponds to option C.

Answer

The playbook ran against all hosts in the default inventory

Answer

The playbook used the implicit localhost but it does not match 'all', causing no tasks to run

Answer

The playbook failed because no hosts matched

Question 8

Refer to the exhibit. An administrator deployed this configuration using the controller_configuration role. After deployment, user jdoe can administer Engineering organization but cannot launch a job template within it. What is the most likely reason?

Accepted Answer

The user needs to be added to the job template's role specifically. In Ansible Tower/AWX, organization-level admin roles grant administrative privileges over the organization's objects (e.g., users, teams, inventories) but do not automatically confer execute permissions on specific job templates. To launch a job template, a user must have the 'execute' role on that job template itself, either directly or via a team or user role assignment. Since user jdoe can administer the Engineering organization but cannot launch a job template, the missing piece is the explicit job template role assignment.

Answer

The admin role for organization does not include job template launch permissions

Answer

The user's password is vault-encrypted and cannot be decrypted

Answer

The role assignment should be at the team level, not user level

Question 9

Refer to the exhibit. An automation job failed with the given error. What is the most likely cause?

Accepted Answer

The SSH key is not authorized for the remote user. The error message indicates an SSH authentication failure, which occurs when the SSH key presented by the control node is not authorized for the remote user's account. This is the most likely cause because Ansible relies on SSH key-based authentication by default, and a missing or mismatched public key on the remote host will prevent the connection.

Answer

The playbook syntax is incorrect

Answer

The SSH port is blocked

Answer

The remote host is unreachable

Question 10

Which two actions are appropriate when configuring a custom execution environment for an automation controller job? (Choose two.)

Accepted Answer

Building the execution environment using ansible-builder. `ansible-builder` is the official tool for building custom execution environments, which are container images that include Ansible, collections, and dependencies needed for automation controller jobs. Option E is correct because a Containerfile (or Dockerfile) defines the base image, packages, and Python dependencies required for the custom execution environment, and it is used by `ansible-builder` or directly with `podman build` to create the image.

Answer

Storing the execution environment in a public registry only

Answer

Setting the execution_environment_image in the project's SCM

Answer

Using the default execution environment provided by controller

Question 11

An organization needs to implement security best practices for Ansible automation. Which three measures should be taken? (Choose three.)

Accepted Answer

Use ansible-vault to encrypt sensitive variables. `ansible-vault` is the built-in Ansible tool for encrypting sensitive data such as passwords, API keys, and secret variables. It uses AES-256 encryption to protect secrets at rest, ensuring they are not exposed in plain text within playbooks, inventory files, or version control systems. This is a fundamental security best practice for any Ansible automation environment.

Answer

Store all secrets in plain text in repository

Answer

Disable SSH host key checking globally

Question 12

Which two conditions could prevent an automation controller job from starting? (Choose two.)

Accepted Answer

The project sync is pending. Options B and C are correct. A pending project sync means the project source is not yet synchronized, so the job template cannot access the required project files, preventing the job from starting. A disabled job template explicitly prevents it from being launched. Option A is incorrect: an empty inventory source does not block job start; the job will start and then fail due to no hosts. Option D is incorrect: a system auditor can still launch jobs if they have the appropriate permissions. Option E is incorrect: using the 'latest' image tag is allowed and does not prevent the job from starting.

Answer

The inventory source is empty

Answer

The user is a system auditor

Answer

The execution environment image tag is 'latest'

Question 13

A systems administrator needs to securely store a database password for use in an Ansible playbook. The password should be encrypted at rest and decrypted only at runtime when the playbook is executed. Which approach should the administrator take?

Accepted Answer

Use the ansible-vault encrypt_string command to encrypt the password and store it in a variables file.. `ansible-vault encrypt_string` encrypts the password at rest using AES-256, storing it as a ciphertext string in a variables file. At runtime, when the playbook is executed with `--ask-vault-pass` or a vault password file, Ansible decrypts the value transparently, ensuring the plaintext password is never written to disk or logs.

Answer

Store the password as a plain text variable in the playbook and use the no_log: yes directive to prevent logging.

Answer

Store the password in an unprotected external file and reference it with include_vars.

Answer

Save the password in an environment variable and access it via lookup('env','DB_PASS').

Question 14

An automation team wants to grant a group of operators the ability to launch job templates in automation controller but prevent them from modifying the job template configuration. They also need to troubleshoot failed jobs by viewing job output. Which predefined role should be assigned to the team for a specific job template?

Accepted Answer

Execute role. The Execute role is the correct predefined role because it grants permission to launch a job template and view job output (including standard out and error logs) without allowing any modifications to the job template's configuration. This aligns exactly with the requirement: operators can execute and troubleshoot failed jobs but cannot edit the template.

Answer

Read role

Answer

Admin role

Answer

Update role

Question 15

A company uses Ansible Automation Platform and wants to ensure that all playbook runs are logged for audit purposes. What is the simplest way to achieve centralized logging of job runs?

Accepted Answer

Configure the syslog server in the automation controller settings.. Automation Controller (formerly Ansible Tower) has a built-in setting under 'System → Logging' where you can configure a syslog server (e.g., using RFC 5424). Once configured, all job runs, playbook output, and audit events are automatically forwarded to that central syslog server without modifying any playbooks or adding custom callbacks. This is the simplest, most centralized, and most maintainable approach for audit logging.

Answer

Use the logging module in each playbook to write to a central syslog.

Answer

Add a playbook callback that sends output to a file on each node.

Answer

Enable verbose logging in the inventory file.