EX294 Create content collections and execution environments Practice Test 5 — 15 Questions

Question 1

Which TWO statements about execution environments are true?

Accepted Answer

Execution environments can include both Ansible and system dependencies.. Execution environments bundle both Ansible-specific dependencies (e.g., ansible-core, collections) and system-level dependencies (e.g., Python libraries, SSH clients), making statement A correct. Statement E is correct because execution environments are container images that conform to the Open Container Initiative (OCI) standard. Statement B is incorrect because execution environments can be used directly with ansible-playbook by setting the ANSIBLE_EXECUTION_ENVIRONMENT environment variable or using the --execution-environment flag; they are not limited to ansible-navigator. Statement C is incorrect because while ansible-builder is a common tool, other methods like Dockerfiles or pre-built images from registries are also valid. Statement D is incorrect because ansible-navigator is not mandatory; ansible-playbook or ansible-runner can also use execution environments.

Answer

Execution environments cannot be used with ansible-playbook directly.

Answer

Execution environments must be built using ansible-builder.

Answer

Ansible Navigator is required to use execution environments.

Question 2

Which THREE components are typically included in an execution environment?

Accepted Answer

Base OS image. An execution environment is a container image that provides a consistent, self-contained runtime for Ansible automation. It must include a base OS image (e.g., Red Hat Universal Base Image) to host the environment, Ansible Core and collections for automation logic, and a Python interpreter with its dependencies to execute modules and manage system interactions. These three components ensure portability and reproducibility across different control nodes.

Answer

Ansible Navigator

Answer

Ansible Tower/AWX

Question 3

Refer to the exhibit. An administrator has configured ansible.cfg as shown. Which command will successfully install the 'community.general' collection from this server?

Accepted Answer

ansible-galaxy collection install community.general. The ansible.cfg file shown in the exhibit sets the `server` key under the `[galaxy]` section to a custom server URL (e.g., `https://private-galaxy.example.com`). When no `--server` flag is provided, `ansible-galaxy collection install` automatically uses the server defined in `ansible.cfg`. Therefore, the simple command `ansible-galaxy collection install community.general` will install the collection from the configured private server.

Answer

ansible-galaxy collection install community.general --server=https://galaxy.ansible.com

Answer

ansible-galaxy collection install community.general --ignore-certs

Answer

ansible-galaxy collection install community.general --force-with-deps

Question 4

Refer to the exhibit. A developer builds an execution environment using this execution-environment.yml. After building, the container starts but ansible-navigator cannot connect to the container because the required SSH packages are missing. Which file most likely needs to be updated?

Accepted Answer

bindep.txt. D is correct because `bindep.txt` specifies system-level package dependencies (like `openssh-clients` or `sshpass`) that must be installed in the container image. When building an execution environment, `ansible-builder` reads `bindep.txt` to install RPM packages via `dnf` (or `apt` on Debian-based images). If SSH packages are missing, the `bindep.txt` file is the most likely place to add them, as it directly controls which system packages are included in the final image.

Answer

The base image itself

Answer

requirements.yml

Answer

requirements.txt

Question 5

An organization uses ansible-builder to create an execution environment (EE) for network automation. The EE includes a custom collection 'acme.network' that requires the 'netaddr' Python library. The ansible-builder definition file (execution-environment.yml) lists 'netaddr' in the requirements.txt under dependencies.python. After building the EE and pushing it to the local registry, a user runs ansible-navigator with the EE and executes a playbook that uses a module from 'acme.network'. The playbook fails with an error that 'netaddr' is not installed. The user checks the running container and confirms that 'netaddr' is installed via pip list. What is the most likely cause?

Accepted Answer

The Python environment in the EE has multiple versions and netaddr is installed in the wrong one.. Execution environments built with ansible-builder can contain multiple Python interpreters (e.g., system Python and a virtual environment). The 'netaddr' library might be installed in the system Python but the Ansible controller process inside the EE runs from a different Python environment (often a virtual environment under /usr/share/ansible). When the playbook executes, it imports from the wrong Python, causing the 'not installed' error despite pip list showing the package.

Answer

The base image for the EE does not include the required system packages for 'netaddr'.

Answer

The collection 'acme.network' is not installed in the EE.

Answer

The ansible-navigator command is using a different EE than the one built.

Question 6

A system administrator wants to build an Ansible execution environment using ansible-builder. Which file format is required to define the base image, dependencies, and additional Python packages for the build?

Accepted Answer

execution-environment.yml. `ansible-builder` requires an `execution-environment.yml` file to define the build context, including the base image (under `version: 1`), system-level dependencies (under `dependencies: system:`), and additional Python packages (under `dependencies: python:`). This file is the mandatory definition file for building an Ansible Execution Environment (EE) using `ansible-builder build`.

Answer

ansible-navigator.yml

Answer

Containerfile

Answer

requirements.yml

Question 7

An organization uses a private automation hub to distribute collections. A developer has created a new collection and needs to ensure it is available in the hub for others. Which command should the developer use to upload the collection to the private automation hub?

Accepted Answer

ansible-galaxy collection publish. `ansible-galaxy collection publish` is the command specifically designed to upload a built collection artifact (a .tar.gz file) to a Galaxy server, including a private automation hub. This command sends the collection to the configured Galaxy server endpoint, making it available for others to install via `ansible-galaxy collection install`.

Answer

ansible-galaxy collection import

Answer

ansible-galaxy collection build

Answer

ansible-galaxy collection install

Question 8

A team is setting up an Ansible execution environment that requires a specific version of a Python library that is not available in the default base image. The team wants to minimize the size of the final container. Which approach should they take in the execution-environment.yml file?

Accepted Answer

Use the 'dependencies' key with 'python' to specify the library and version.. The `dependencies` key in `execution-environment.yml` allows specifying Python libraries and their versions under the `python` subkey. Ansible Builder will then install these dependencies during the build process, ensuring the required library is available without bloating the final container with unnecessary layers or manual RUN commands.

Answer

Use the 'additional_build_steps' key to add a RUN command that installs the library via pip.

Answer

Use the 'base_image' key to point to a custom image that already contains the library.

Answer

Use the 'galaxy' key to install the library from a collection.

Question 9

An Ansible content creator wants to ensure that a collection is properly structured and meets Red Hat's best practices. Which TWO of the following are required files in a valid Ansible collection structure?

Accepted Answer

meta/runtime.yml. A is correct because `meta/runtime.yml` is a required file in a valid Ansible collection structure. It defines the collection's runtime dependencies, such as minimum Ansible version and action group mappings, ensuring the collection is compatible with the Ansible runtime environment. B is correct because `galaxy.yml` is the mandatory metadata file that describes the collection's name, version, authors, and other essential information, and it is required for publishing to Ansible Galaxy or Automation Hub.

Answer

plugins/README.md

Answer

requirements.yml

Answer

roles/requirements.yml

Question 10

A system administrator is troubleshooting an execution environment that fails to build. The error indicates that a required collection cannot be found. Which THREE of the following actions could resolve the issue?

Accepted Answer

Verify that the collection is listed in the 'dependencies' section of the execution-environment.yml under 'galaxy'.. The 'dependencies' section under 'galaxy' in the execution-environment.yml file is the standard mechanism for declaring required Ansible collections. When the execution environment is built, ansible-builder reads this section and automatically installs the listed collections from the configured Galaxy server. If a required collection is missing, verifying its presence in this section ensures it will be included in the build.

Answer

Add the collection to the 'additional_build_steps' section with a manual 'ansible-galaxy collection install' command.

Answer

Include the collection in the 'build_ignore' list to skip it.

Question 11

You are responsible for maintaining a team of 10 Ansible developers. They all rely on a shared collection stored in a private Git repository. Recently, multiple developers reported that their playbooks are failing because they have different versions of the collection installed locally. You decide to standardize the environment by creating a consistent Ansible execution environment. You have a base image of Red Hat Enterprise Linux 8.6, and you need to include the collection from the Git repository. Additionally, the execution environment should be rebuilt automatically whenever the collection is updated. Which approach should you take?

Accepted Answer

Write an execution-environment.yml that specifies the base image and uses the 'git' option under 'dependencies' to pull the latest collection from the Git repo, then configure a webhook to rebuild the image on each push.. It uses an execution-environment.yml file with the 'git' option under 'dependencies' to pull the collection directly from the private Git repository during the image build process. This ensures that every build includes the latest version of the collection, and by configuring a webhook (e.g., from GitLab or GitHub) to trigger a rebuild on each push, the environment is automatically standardized across all developers. This approach directly addresses the version inconsistency problem by creating a consistent, version-controlled execution environment.

Answer

Use ansible-navigator to run the playbooks directly from the Git repository without building an execution environment.

Answer

Create a requirements.yml file for the developers to install the collection manually on their local machines.

Answer

Build the execution environment once using ansible-builder and distribute the resulting container image to all developers manually.

Question 12

Your team maintains a collection that includes custom modules and plugins. You have been tasked with creating a content collection that adheres to the Red Hat Ansible Content Collection requirements. You have created the directory structure and written the collection code. Now you need to package the collection for distribution to your internal automation hub. You run 'ansible-galaxy collection build' and it completes successfully, generating a tarball. However, when you try to publish it to your private automation hub using 'ansible-galaxy collection publish', you get an authentication error. You have verified that your automation hub server URL and API token are correct. What is the most likely cause of the error?

Accepted Answer

The 'namespace' or 'name' in galaxy.yml does not match the namespace you are allowed to publish to on the automation hub.. The authentication error despite correct server URL and API token indicates that the issue is not with credentials or connectivity, but with authorization. Ansible Automation Hub enforces namespace-based access control: the `namespace` field in `galaxy.yml` must match a namespace you are permitted to publish to. If the namespace does not match, the hub rejects the upload with an authentication/authorization error, even though the token itself is valid.

Answer

The automation hub server is not reachable from your network.

Answer

The collection tarball is corrupted and needs to be rebuilt.

Answer

The collection contains a module that violates a content policy enforced by the hub.

Question 13

You are building an execution environment for a large enterprise that requires several collections from both Red Hat Automation Hub and an internal GitLab repository. Your execution-environment.yml file includes both sources. However, the build process consistently fails during the 'adding collections' step with an error indicating that a specific collection from the internal Git repository cannot be found. You have confirmed that the Git repository URL and branch are correct, and that the repository is accessible from the build host. The collection's galaxy.yml file exists and is valid. What is the most likely reason for the failure?

Accepted Answer

The ansible-builder process does not have the necessary Git credentials configured.. The ansible-builder process requires Git credentials to clone collections from private Git repositories. Even if the URL and branch are correct and the repository is accessible from the build host, the builder itself may not have the necessary SSH keys or HTTPS credentials configured. This is a common oversight when using internal GitLab repositories, as the builder runs in a containerized environment that does not inherit the host's credentials by default.

Answer

The base image does not have Git installed.

Answer

The collection's Galaxy namespace conflicts with a collection from Automation Hub.

Answer

The 'requirements.yml' file for the internal collection is missing.

Question 14

Your organization is migrating from manually maintained control nodes to using execution environments. You have created an execution environment that includes all necessary collections and Python dependencies. You want to ensure that developers use this execution environment when running playbooks. You have configured ansible-navigator on their workstations. However, some developers report that when they run a playbook, it uses the local installation of Ansible instead of the execution environment. What should you check first?

Accepted Answer

Ensure that the developers are using the 'ansible-navigator run' command instead of 'ansible-playbook'.. `ansible-navigator` is the CLI tool designed to run Ansible inside an execution environment. If developers run `ansible-playbook` directly, it uses the locally installed Ansible, bypassing the execution environment entirely. The question states that `ansible-navigator` is configured on their workstations, but the developers must use the `ansible-navigator run` subcommand to invoke playbooks within the containerized environment.

Answer

Confirm that the developers have installed ansible-builder locally.

Answer

Verify that the ansible-navigator configuration file points to the correct execution environment image.

Answer

Check that the execution environment container is running on the developers' machines.

Question 15

Your security team requires that all containers used in production must be scanned for vulnerabilities and must not contain any unnecessary packages to reduce attack surface. You are building an execution environment based on the 'ee-minimal-rhel8' image from Red Hat. You need to add a custom Python library named 'my_lib' that is available on a private PyPI server. You also need to install a collection from a private Git repository. The execution environment must be as small as possible. Which approach to building the execution environment satisfies the security and size requirements?

Accepted Answer

Use a multi-stage build in the execution-environment.yml by specifying 'additional_build_steps' to first install build dependencies, then install the library and collection, and finally remove build dependencies.. A multi-stage build in the execution-environment.yml using 'additional_build_steps' allows you to install build dependencies (e.g., gcc, python3-devel) needed to compile 'my_lib', install the library from the private PyPI server, install the collection from the private Git repository, and then remove all build dependencies in a subsequent stage. This results in a final image that contains only the runtime artifacts, minimizing the attack surface and image size, satisfying the security and size requirements.

Answer

Use the 'dependencies' key for the Python library and the 'git' option for the collection, which automatically handles minimization.

Answer

Build a custom base image that already includes the library and collection, then reference it as the base image.

Answer

Add the library and collection installation commands to the 'additional_build_steps' section without any cleanup steps.