EX294 Create content collections and execution environments — 25 Questions

Question 1

An organization uses custom Ansible plugins stored in a collection. A junior admin reports that after updating the collection to version 2.0.0, a playbook that uses a custom filter plugin fails with 'undefined filter'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The filter plugin was placed in the wrong directory inside the collection.. In Ansible collections, filter plugins must reside in the `plugins/filter/` directory within the collection structure. If the plugin is placed in the wrong directory (e.g., `plugins/modules/` or `plugins/lookup/`), Ansible will not load it as a filter, resulting in an 'undefined filter' error. The collection update to version 2.0.0 likely reorganized the directory structure, causing the filter to be misplaced.

Answer

The playbook uses an outdated syntax that is incompatible with the new collection.

Answer

The playbook does not use the fully qualified collection name (FQCN) for the filter.

Answer

The collection's metadata file galaxy.yml is missing a dependency declaration.

Question 2

A user wants to run a playbook that uses a module from 'myorg.mycollection'. The playbook is located in /home/user/projects. Which of the following is true about the collection discovery?

Accepted Answer

Ansible will automatically find the collection in the default search path.. Ansible automatically searches for collections in the default search path, which includes the collections directory adjacent to the playbook. Since the playbook is located in /home/user/projects, Ansible will look in /home/user/projects/collections/ansible_collections/myorg/mycollection, among other default paths, without requiring any environment variable or manual configuration.

Answer

The user must set the ANSIBLE_COLLECTIONS_PATH environment variable.

Answer

The collection is not installed, so the playbook will fail.

Answer

Ansible will look only in /usr/share/ansible/collections.

Question 3

What is the most likely cause of the build failure?

Accepted Answer

The base image already includes python3-devel, causing a conflict with the bindep.txt entry.. The build failure is most likely caused by a conflict between the base image's pre-installed python3-devel package and the bindep.txt entry that also specifies python3-devel. In Ansible Builder, bindep.txt lists system packages to install via dnf, but if the base image already includes that package, the build process may fail due to duplicate or conflicting package manager operations, especially if the base image uses a different package version or repository configuration.

Answer

The package_manager_path should be /usr/bin/dnf.

Answer

The version field in execution-environment.yml is incorrect.

Answer

The base image name is misspelled.

Question 4

You are an automation engineer at a large enterprise. The company uses Ansible Automation Platform 2.x and has a private Automation Hub server. The security team mandates that all execution environments must be built from a hardened base image that has been approved by the security team. The base image is stored in a private container registry at registry.internal.company.com/hardened-ee:latest. You need to create an execution environment that includes a custom collection 'company.tools' which is hosted on the private Automation Hub. Additionally, the execution environment must include the Python library 'cryptography' version 3.4.8. You have created the following files:

execution-environment.yml:
---
version: 3
images:
  base_image:
    name: registry.internal.company.com/hardened-ee:latest
options:
  package_manager_path: /usr/bin/microdnf
dependencies:
  galaxy: requirements.yml
  python: requirements.txt

requirements.yml:
---
collections:
  - name: company.tools
    source: https://automationhub.company.com/api/galaxy/content/private/

requirements.txt:
cryptography==3.4.8

When you run 'ansible-builder build -f execution-environment.yml', the build fails with an error: 'Error: Failed to resolve dependency cryptography==3.4.8'. Based on this scenario, what is the most likely cause of the failure?

Accepted Answer

The base image already includes cryptography but not version 3.4.8, causing a version conflict.. The error 'Failed to resolve dependency cryptography==3.4.8' indicates a version conflict with the Python cryptography library already present in the hardened base image. The base image likely includes a different version of cryptography, and pip cannot satisfy the pinned version constraint due to conflicts with the pre-installed package. Ansible Builder uses pip to install Python dependencies, and if the base image has a conflicting version, the build fails unless the dependency is unpinned or the base image is adjusted.

Answer

The requirements.yml file has an incorrect source URL for the private Automation Hub.

Answer

The execution-environment.yml is missing the 'system' dependency section for bindep.txt.

Answer

The package_manager_path should be /usr/bin/dnf instead of microdnf.

Question 5

A user runs the commands shown in the exhibit. The execution environment (EE) builds successfully but the playbook run fails with the error. What is the most likely cause?

Accepted Answer

The collection 'community.general' was not included in the execution environment definition file.. The error indicates that the playbook requires the 'community.general' collection, which is not available in the execution environment. Since the EE builds successfully but the playbook fails, the most likely cause is that the collection was omitted from the execution environment definition file (e.g., execution-environment.yml or requirements.yml). Without it, the collection is not installed in the EE, causing the playbook to fail at runtime.

Answer

The collections_path in ansible.cfg points to a non-existent directory.

Answer

The execution environment image tag is incorrect.

Answer

The --pp never flag prevents the EE from being pulled.

Question 6

You are a Red Hat Certified Engineer tasked with creating a content collection for your organization. The collection will contain roles and modules used by multiple teams. The requirements are: (1) The collection must follow the Ansible community structure. (2) It must include a module that manages network devices. (3) The collection must be versioned and published to Automation Hub. (4) You must provide a minimal working example for other developers. After initial development, you run 'ansible-galaxy collection build' and it fails with 'ERROR! Unknown file type in collection: .gitkeep'. The collection directory contains:

- galaxy.yml
- plugins/modules/network_config.py
- roles/network/
- tests/
- .gitkeep (in tests/)

What single action should you take to resolve the build error?

Accepted Answer

Remove the .gitkeep file from the collection.. The `ansible-galaxy collection build` command fails because it encounters a `.gitkeep` file inside the `tests/` directory, which is not a recognized file type for Ansible collections. The correct action is to remove the `.gitkeep` file, as Ansible collections only allow specific file types (e.g., `.yml`, `.yaml`, `.py`, `.rst`, `.md`, `.txt`, `.cfg`, `.json`, `.j2`, `.ps1`, `.psm1`, `.psd1`, `.csv`, `.env`, `.gitignore`, `.galaxy_ignore.yml`, and a few others). The `.gitkeep` file is not in this allowed list, causing the build to abort.

Answer

Add a 'namespace' field to galaxy.yml.

Answer

Create a .galaxy_ignore.yml file to exclude .gitkeep.

Answer

Move the network_config.py module to a subdirectory named 'modules'.

Question 7

A developer creates a collection and wants to ensure it includes a required Python library for a module. Where should this dependency be declared?

Accepted Answer

In the galaxy.yml file under dependencies.. In Ansible collections, Python library dependencies for modules are declared in the `galaxy.yml` file under the `dependencies` key. This ensures that when the collection is installed via `ansible-galaxy collection install`, the required Python packages are automatically resolved and installed. The `dependencies` field in `galaxy.yml` specifically supports listing Python package requirements using the format `python: package_name`.

Answer

In a requirements.txt file at the collection root.

Answer

In the meta/runtime.yml file.

Answer

In the collection's README.

Question 8

An organization uses a private Git repository to store Ansible content collections. They want to automate the building of execution environments that include these collections. Which approach is recommended?

Accepted Answer

Build the collection manually, publish it to a private Automation Hub, then reference it in the EE.. The recommended workflow for including private collections in an execution environment is to build the collection, publish it to a private Automation Hub, and then reference it in the `execution-environment.yml` file. This ensures the collection is available as a signed, versioned artifact that `ansible-builder` can pull during the build process, maintaining integrity and reproducibility without exposing Git credentials or requiring network access during build.

Answer

Store the collection tarball in a Git LFS and use an ADD command in the base image.

Answer

Add the Git repository as a source in the execution-environment.yml using the 'git' type.

Answer

Use ansible-builder to clone the repository during build with a pre-build script.

Question 9

An execution environment fails to start because the container image is missing the ansible-runner package. Which step in the build process should have included it?

Accepted Answer

The base image selection in execution-environment.yml. The base image specified in the `execution-environment.yml` file determines the foundational operating system and packages for the execution environment. If the base image lacks `ansible-runner`, the environment will fail to start, as `ansible-runner` is essential for orchestrating playbook execution. The base image selection is the first step in the build process where this dependency must be satisfied.

Answer

The ansible-runner role in the builder definition

Answer

The requirement to install ansible-runner via pip in the containerfile

Answer

The additional_dependencies section in execution-environment.yml

Question 10

Which THREE actions are required to successfully publish a collection to Automation Hub?

Accepted Answer

Build the collection with ansible-galaxy collection build.. Option A is correct because publishing to Automation Hub requires a distributable artifact, which is produced by running `ansible-galaxy collection build` to create the collection tarball (e.g., namespace-name-version.tar.gz) from the galaxy.yml metadata. Option B is correct because Automation Hub authenticates uploads via an API token, which you generate in the Automation Hub UI and then use with `ansible-galaxy collection publish` (via `--token` or the configured token in ansible.cfg) to authorize the push. Option E is correct because Automation Hub enforces immutable, unique collection versions per namespace/name; attempting to publish a version that already exists is rejected, so the version in galaxy.yml must be incremented before building and publishing. Option C is not required because GPG signing is an optional integrity/trust feature (using `--sign` with a configured signing key), not a mandatory step for publishing. Option D is not a real required action because `ansible-galaxy collection test` is not a standard command used in the publish workflow; validation is typically done via `ansible-test` or CI, and it is not a prerequisite for uploading to Automation Hub.

Answer

Sign the collection with GPG.

Answer

Run ansible-galaxy collection test.

Question 11

Refer to the exhibit. A user includes this in the execution-environment.yml. The build process fails because the second collection cannot be resolved. What is the most likely reason?

Accepted Answer

The source URL is not a valid Galaxy server endpoint.. The execution-environment.yml references a Galaxy server endpoint that is not a valid Ansible Galaxy server. Ansible Builder resolves collections from Galaxy servers, and if the URL does not point to a recognized Galaxy API endpoint (e.g., https://galaxy.ansible.com), the build process cannot fetch the collection. The error indicates the second collection cannot be resolved, which directly points to an invalid or unreachable Galaxy server URL.

Answer

The format of the version constraint is invalid.

Answer

The source URL does not include the required endpoint like '/api/v3/'.

Answer

The second collection is not authorized for download.

Question 12

A developer is building an execution environment using `ansible-builder` and encounters the error: 'Error: Failed to pull base image: manifest for registry.redhat.io/ansible-automation-platform/ansible-builder-rhel8:2.0.0 not found: manifest unknown.' The developer checks the registry and verifies that the image exists with a different tag. Which action should the developer take to resolve the issue?

Accepted Answer

Change the tag in `execution-environment.yml` to a valid tag, such as 'latest'.. The error indicates the specified tag '2.0.0' does not exist in the registry. The developer confirmed the image exists with a different tag, so updating the tag in `execution-environment.yml` to a valid one, such as 'latest', resolves the manifest lookup failure. `ansible-builder` uses this file to define the base image and tag for building the execution environment.

Answer

Run `podman login registry.redhat.io` to authenticate.

Answer

Modify the `execution-environment.yml` to use a different base image from Docker Hub.

Answer

Update the container runtime to the latest version.

Question 13

An organization wants to share a collection internally across multiple teams while ensuring that each team can only use specific modules from the collection. Which approach best supports this requirement?

Accepted Answer

Create separate collections for each team and publish them to the private Automation Hub.. It uses separate collections published to a private Automation Hub, which allows each team to access only the specific collection containing the modules they need. This approach leverages Automation Hub's role-based access control (RBAC) to enforce team-specific permissions, ensuring that teams cannot see or use modules from other collections.

Answer

Use a single collection and annotate modules with metadata to restrict access.

Answer

Store the collection in a Git repository and use branch permissions to hide modules.

Answer

Publish a single collection with all modules and rely on documentation to indicate which modules are for which team.

Question 14

A developer has created a collection and needs to publish it to a private Automation Hub. Which command should be used to upload the collection archive?

Accepted Answer

`ansible-galaxy collection publish ./my-namespace-my_collection-1.0.0.tar.gz`. The correct command to upload a collection archive to a private Automation Hub is `ansible-galaxy collection publish ./my-namespace-my_collection-1.0.0.tar.gz`. This command authenticates to the configured Automation Hub server (as defined in `ansible.cfg` or the `--server` flag) and publishes the tarball, making it available for other users to install. The `publish` subcommand is specifically designed for this purpose, handling the API call to the Galaxy or Automation Hub server.

Answer

`ansible-galaxy collection server upload ./tar.gz`

Answer

`ansible-galaxy role import my-namespace my_collection`

Answer

`ansible-galaxy collection upload ./my-namespace-my_collection-1.0.0.tar.gz`

Question 15

A team uses `ansible-navigator` to run playbooks with an execution environment. The playbook requires a collection that is not included in the execution environment. Which approach allows the team to use the collection without rebuilding the execution environment?

Accepted Answer

Set the `ANSIBLE_COLLECTIONS_PATHS` environment variable to a directory containing the collection and use `--execution-environment-image` with the EE.. Setting the `ANSIBLE_COLLECTIONS_PATHS` environment variable tells `ansible-navigator` to look for collections in a specified directory on the host, and using `--execution-environment-image` ensures the correct execution environment image is used. This allows the team to inject a collection into the container at runtime without modifying the execution environment image itself, as `ansible-navigator` mounts the specified host directory into the container automatically.

Answer

Use the `--container-options` flag to mount a volume with the collection.

Answer

Use `ansible-galaxy collection install` inside the execution environment at runtime.

Answer

Rebuild the execution environment with the collection included.

Question 16

Which TWO of the following are required in a valid Ansible collection directory structure?

Accepted Answer

`galaxy.yml` file. Option B (`galaxy.yml` file) is correct because every Ansible collection must contain a `galaxy.yml` metadata file at its root, which defines the collection's namespace, name, version, authors, and dependencies needed for building and publishing with `ansible-galaxy collection build`. Option D (`plugins/` directory) is correct because a valid collection requires at least one content directory such as `plugins/`, which holds modules, action plugins, filter plugins, and other plugin types that give the collection its functionality. The `tests/` directory (A), `docs/` directory (C), and `roles/` directory (E) are optional components; while commonly present in well-structured collections, they are not mandatory for the collection to be considered valid or buildable.

Answer

`tests/` directory

Answer

`docs/` directory

Answer

`roles/` directory

Question 17

Which THREE of the following are valid directives that can be used in an `execution-environment.yml` file for `ansible-builder`?

Accepted Answer

`version:`. Option B (`version:`) is correct because `execution-environment.yml` requires a top-level `version` key (e.g., `version: 3`) that tells ansible-builder which schema/format of the definition file it is parsing. Option D (`additional_build_steps:`) is correct because ansible-builder supports this directive to inject custom Containerfile instructions at defined stages such as `prepend_base`, `append_base`, `prepend_galaxy`, `append_galaxy`, `prepend_final`, and `append_final`. Option E (`dependencies:`) is correct because it is the main section of the definition file, grouping subsections like `galaxy`, `python`, `system`, and `ansible_core`/`ansible_runner` that describe what must be installed into the execution environment image. Option A (`system_packages:`) is not a valid top-level directive; OS packages are declared under `dependencies: system:`. Option C (`python_requirements:`) is likewise invalid as a top-level key; Python packages are declared under `dependencies: python:` (or via a referenced requirements file).

Answer

`system_packages:`

Answer

`python_requirements:`

Question 18

Which TWO of the following are valid methods to install a collection from a private Automation Hub?

Accepted Answer

Configure `server_list` in `ansible.cfg` under `[galaxy]` with the Automation Hub URL and then run `ansible-galaxy collection install my_namespace.my_collection`.. Option C is correct because defining a `server_list` entry under the `[galaxy]` section of `ansible.cfg` (pointing at the Automation Hub URL, typically with an associated token via `[galaxy_server.<name>]`) lets `ansible-galaxy collection install my_namespace.my_collection` resolve and download the collection from that private Automation Hub without extra CLI flags. Option D is correct because `ansible-galaxy collection install` accepts the `--server` (alias `-s`) option with an explicit Automation Hub API URL such as `https://automationhub.example.com`, directing the install to that private hub. Option A is not valid because `--server automationhub` must be a URL or a configured server name from `server_list`; a bare string like `automationhub` is not a resolvable server unless explicitly defined as such, and the option as written does not establish that. Option B is wrong because `ansible-navigator run` executes playbooks and its `--pull-policy`/`--pp` flag controls execution-environment image pulling, not collection installation from Automation Hub. Option E is wrong because manually dropping a tarball into a `collections/` directory is not a supported installation method — collections must be installed via `ansible-galaxy collection install` (or built/installed from a tarball using that command), not by file placement.

Answer

`ansible-galaxy collection install my_namespace.my_collection --server automationhub`

Answer

`ansible-navigator run --pp never --pull-policy missing -- ... `

Answer

Download the tarball and place it in the `collections/` directory of the role path.

Question 19

Based on the exhibit, which collection provides modules for managing Red Hat Insights subscriptions?

Accepted Answer

`redhat.insights`. The `redhat.insights` collection is the official Ansible collection from Red Hat that provides modules specifically for managing Red Hat Insights subscriptions, including `insights_register` and `insights_unregister`. This collection is maintained by Red Hat and is the correct source for automating Insights registration and subscription management tasks.

Answer

`community.general`

Answer

`ansible.posix`

Answer

`insights`

Question 20

An execution environment is built using ansible-builder. The definition file includes a base image from registry.redhat.io. After building, the container runs but ansible-navigator can't find the EE. What is the most likely cause?

Accepted Answer

The EE was not pushed to a registry accessible by ansible-navigator.. The most likely cause is that the execution environment (EE) was built locally but not pushed to a registry that `ansible-navigator` can access. By default, `ansible-navigator` pulls EEs from a container registry (e.g., `registry.redhat.io` or a private registry) specified in its configuration; it does not automatically discover locally built images. If the EE is only present in the local Docker/Podman store, `ansible-navigator` will fail to find it, resulting in a runtime error.

Answer

ansible-navigator uses a different Python interpreter.

Answer

The base image is not compatible with the installed collections.

Answer

The EE was not tagged correctly.