EX294 Deploy Ansible Automation Platform — 40 Questions

Question 1

A DevOps engineer is troubleshooting an Ansible Automation Platform deployment where ansible-navigator fails to run a playbook, showing the error 'Error: Unable to pull execution environment image'. The ansible-navigator configuration file is shown in the exhibit. Which change should the engineer make to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change 'pull policy' from 'missing' to 'always'. The error 'Unable to pull execution environment image' indicates that the image specified in the ansible-navigator configuration cannot be retrieved from the registry. Setting the 'pull policy' to 'always' forces ansible-navigator to attempt a fresh pull of the execution environment image every time, which can resolve transient network issues, authentication problems, or stale local image caches that cause the pull to fail when the policy is 'missing'.

Answer

Set 'mode' to 'interactive' instead of 'stdout'

Answer

Change the execution-environment image to 'registry.redhat.io/ansible-automation-platform-24/ee-minimal-rhel8:latest'

Answer

Set 'playbook-artifact enable' to 'true'

Question 2

A systems administrator is deploying Ansible Automation Platform 2.4 using the provided setup script. The installation fails with the error shown in the exhibit. Based on the exhibit, what is the most likely cause of the failure?

Accepted Answer

The PostgreSQL service is not running on the database server.. The error exhibit indicates that the installer cannot connect to the PostgreSQL database. The most common cause of this failure is that the PostgreSQL service is not running on the database server, preventing the Ansible Automation Platform setup script from establishing a connection. Without the database service active, the installer cannot proceed with the deployment.

Answer

The installer requires a local PostgreSQL database; using a remote database is not supported.

Answer

The database password specified in setup.sh does not match the actual PostgreSQL password.

Answer

SELinux is blocking the ansible-navigator process from reaching the database.

Question 3

You are deploying Red Hat Ansible Automation Platform in a restricted network environment where the automation controller, automation hub, and execution nodes cannot access the internet. You have successfully installed the automation controller and automation hub on separate RHEL 8 servers using a local repository. The automation hub is configured to sync collections from a local mirror. After deployment, you attempt to create a new job template that uses a collection from automation hub, but the job template creation fails with the error: 'Failed to find collection' for a collection that exists in automation hub. The execution nodes are subscribed to the same local repository. The automation controller is configured with the automation hub as the default collections server. What is the most likely cause?

Accepted Answer

The automation controller is configured with the default cloud.redhat.com as the collections server instead of the local automation hub URL.. The automation controller must be explicitly configured to use the local automation hub as the default collections server. If it defaults to cloud.redhat.com, the controller will attempt to download collections from the internet, which fails in a restricted network environment. The error 'Failed to find collection' indicates the controller cannot reach the configured collections server, not that the collection is missing from the local hub.

Answer

The local repository does not contain the required Ansible Automation Platform packages for the execution nodes.

Answer

The automation controller cannot communicate with the execution nodes due to network restrictions.

Answer

The execution nodes are not registered with the automation controller.

Question 4

Drag and drop the steps to configure an Ansible control node for managing remote hosts into the correct order.

Accepted Answer

1. Install Ansible on the control node. 2. Define an inventory file with remote hosts. 3. Set up SSH key-based authentication. 4. Verify connectivity using `ansible all -m ping`.. Ansible requires installation, inventory definition, SSH key-based authentication, and connectivity verification before managing hosts.

Answer

1. Install Ansible on the control node. 2. Set up SSH key-based authentication. 3. Define an inventory file with remote hosts. 4. Verify connectivity using `ansible all -m ping`.

Answer

1. Define an inventory file with remote hosts. 2. Install Ansible on the control node. 3. Set up SSH key-based authentication. 4. Verify connectivity using `ansible all -m ping`.

Answer

1. Install Ansible on the control node. 2. Define an inventory file with remote hosts. 3. Verify connectivity using `ansible all -m ping`. 4. Set up SSH key-based authentication.

Question 5

A job template consistently fails with 'Authentication failed' for a managed host. The admin has verified that the username/password in the credential is correct and that the host is reachable. What is the most likely remaining cause?

Accepted Answer

The credential is not linked to the job template.. The most likely remaining cause is that the credential is not linked to the job template. Even if the credential contains correct authentication data, the job template will not use it unless the credential is explicitly associated. Without this link, Ansible Tower/AWX cannot authenticate to the managed host, resulting in an 'Authentication failed' error.

Answer

The SSH private key has not been added to the credential.

Answer

The username in the credential is misspelled.

Answer

The host is not reachable on the network.

Question 6

Which THREE of the following are core components of Automation Platform that are installed by default in a standard setup?

Accepted Answer

Automation controller. In a standard Automation Platform installation, the default core components include Automation controller (B), which provides the centralized web UI, REST API, and job scheduling engine for running playbooks; Automation mesh (C), which is the overlay networking and node-type architecture (control, hybrid, execution, hop nodes) that enables distributed execution; and Private Automation Hub (D), which is the on-premises content repository for collections, execution environments, and roles. Red Hat Enterprise Linux (A) is the underlying operating system that hosts the platform, not a component installed by the platform installer itself. Ansible Core (E) is the upstream command-line automation engine that the platform builds upon, but it is not one of the three default installed platform components in the standard setup.

Answer

Red Hat Enterprise Linux

Answer

Ansible Core

Question 7

A job template has failed. Which TWO logs should be examined first to diagnose the issue?

Accepted Answer

/var/log/tower/tower.log. Option A, /var/log/tower/tower.log, is correct because it is the primary Automation Controller (AWX/Tower) service log where the controller records job template launch failures, internal errors, and tracebacks that occur before or during job execution. Option B, /var/log/tower/job_callback.log, is correct because it captures callback events from the job execution environment (the receptor/ansible-runner callback receiver), which is essential for diagnosing why a job template failed after it was dispatched. Option C, the job stdout, is useful for playbook-level output but is not a log file examined first for controller-side job template failures, and it may not exist if the job never started. Option D, /var/log/messages, is a general OS syslog file that lacks the Automation Controller-specific job context needed here. Option E, /var/log/nginx/access.log, only records HTTP access requests to the web UI/API and does not contain job execution or failure details.

Answer

Automation controller job stdout

Answer

/var/log/messages

Answer

/var/log/nginx/access.log

Question 8

An admin checks the job details and sees this error from the API. What is the most likely cause?

Accepted Answer

The callback plugin is not installed on the controller node.. The error from the API indicates that the callback plugin is missing on the controller node. In Ansible Automation Platform, callback plugins must be installed on the controller node (or execution node) where `ansible-runner` processes job events. If the plugin is not present there, the API will report a failure when the job attempts to use it, even if the execution environment contains the plugin.

Answer

The job template is using an execution environment that lacks the plugin.

Answer

The callback plugin name is misspelled in the project.

Answer

The machine credential is invalid.

Question 9

An admin is creating a workflow that must run a survey at the beginning to collect user input. Which node type should be used for the first step?

Accepted Answer

Job Template node with survey enabled. A Job Template node with survey enabled is the correct choice because surveys in Ansible Automation Platform allow you to prompt the user for variables at runtime before the job runs. This is the only node type that can collect user input as the first step in a workflow, as it presents a form to the user and passes the entered values as extra variables to the job.

Answer

Workflow node

Answer

Approval node

Answer

Project Sync or Inventory Sync node

Question 10

An admin wants to use custom Python modules in a job template without affecting the global controller environment. What should be used?

Accepted Answer

Create a custom virtual environment and assign it to the job template.. Custom Python modules must be isolated from the global controller environment to avoid conflicts. Ansible Tower/AWX allows you to create a custom virtual environment and assign it to a job template, ensuring that only the modules installed in that environment are used during job execution, leaving the global controller unaffected.

Answer

Install the modules globally on the controller.

Answer

Execution environment with custom collections.

Answer

Use a custom credential type that includes Python modules.

Question 11

After upgrading AAP, an admin notices that all job templates using a custom virtual environment fail with 'No module named 'foo''. The virtual environment was previously working. What should the admin do first?

Accepted Answer

Recreate the custom virtual environment and reinstall the 'foo' package.. After an AAP upgrade, custom virtual environments are not automatically migrated or preserved; they must be recreated and their packages reinstalled. The 'No module named 'foo'' error indicates that the Python environment no longer contains the required package, so recreating the environment and reinstalling 'foo' is the correct first step to restore functionality.

Answer

Switch the job template to use an execution environment instead.

Answer

Reassign the job template to the default virtual environment.

Answer

Verify that the credential associated with the job template is valid.

Question 12

A systems administrator is installing Ansible Automation Platform on a Red Hat Enterprise Linux 9 server. They download the installer tarball and run `./setup.sh`. The installation fails with an error indicating that the database password is incorrect. What is the most likely cause?

Accepted Answer

The `bootstrap.yml` file has an incorrect value for `pg_password`.. The `pg_password` variable in the `bootstrap.yml` inventory file (or equivalent) sets the PostgreSQL database password. If this value is incorrect or mismatched with the actual database password, the installer will fail during the database connection check with a 'database password is incorrect' error.

Answer

The `admin_password` variable in the inventory file does not match the PostgreSQL password.

Answer

The PostgreSQL server is not listening on the expected port.

Answer

The license file has not been placed in the installer directory.

Question 13

An organization uses Ansible Automation Controller. They have an inventory source that syncs from a Git repository containing `inventory/hosts.yml`. The job template uses this inventory. Recently, the inventory stopped updating. The admin checks the job logs and sees: `ERROR! Could not update inventory source: invalid inventory source definition`. What is the most likely issue?

Accepted Answer

The inventory file `hosts.yml` has a syntax error, such as a missing colon.. The error message 'invalid inventory source definition' indicates that the inventory file itself is malformed, not that there is a connectivity or credential issue. In Ansible Automation Controller, when an inventory source syncs from a Git repository, the controller parses the inventory file (e.g., `hosts.yml`) according to YAML syntax rules. A missing colon would break the YAML structure, causing the controller to reject the file as invalid, which matches the error.

Answer

The Git repository is unreachable due to network issues.

Answer

The project that contains the playbook has been deleted.

Answer

The machine credential stored in the controller has expired.

Question 14

A large enterprise has deployed Ansible Automation Platform with multiple organizations. A team lead needs to allow a junior administrator to create and manage job templates within their own organization, but not modify organizations, users, or system settings. Which RBAC roles should be assigned?

Accepted Answer

Assign the `job_template_admin` role on the specific organization.. The `job_template_admin` role on a specific organization grants the ability to create, edit, and manage job templates within that organization without allowing modifications to organizations, users, or system settings. This is the correct RBAC role for the junior administrator's requirements.

Answer

Assign the `admin` role on the organization.

Answer

Assign the `execute` role on all job templates.

Answer

Assign the `auditor` role on the organization.

Question 15

An administrator wants to use automation mesh to distribute workloads across multiple execution nodes. After configuring mesh topology, some jobs fail with: `Error: No healthy mesh node found for execution`. What is the most likely cause?

Accepted Answer

The execution node is not registered with a unique `node_id`.. Each execution node in an automation mesh must have a unique `node_id` to be properly identified and reachable by the mesh controller. When nodes share a `node_id` or are not registered with a unique identifier, the controller cannot distinguish between them, leading to the 'No healthy mesh node found for execution' error. This uniqueness is critical for the mesh's peer-to-peer routing and health-checking mechanism.

Answer

The mesh nodes are not all connected to each other.

Answer

The `hop` count is set too high in the mesh configuration.

Answer

The `node_type` is set to `control` for all nodes.

Question 16

An administrator is designing a workflow that includes an approval node. The workflow should pause at the approval node until a user with the appropriate role approves or denies. The workflow is triggered by a webhook. After setting up, the webhook successfully starts the workflow, but the approval node is never created. What is the most likely cause?

Accepted Answer

The workflow job template is set to run as a system user, but the approval node requires an actual user to approve.. In Ansible Automation Platform, approval nodes in workflows require a real user to approve or deny the request. If the workflow job template is configured to run as a system user (e.g., the automation controller system user), there is no actual user identity associated with the approval action, so the approval node is never created. The webhook can still trigger the workflow, but the approval node fails to materialize because the system user lacks the necessary user context to generate the approval request.

Answer

The approval node requires a notification template to be configured.

Answer

The approval node's timeout is set to 0, causing it to be skipped.

Answer

The inventory for the workflow does not have proper machine credentials.

Question 17

A user wants to authenticate against Ansible Automation Controller using LDAP. They configure the LDAP settings in the controller UI. After saving, they test the connection and it succeeds. However, when an LDAP user tries to log in, they get an authentication failure. What is the most likely issue?

Accepted Answer

The user has not been mapped to an organization within the LDAP configuration.. In Ansible Automation Controller, LDAP users must be explicitly mapped to an organization within the LDAP configuration. Without this mapping, the user is authenticated by the LDAP server but the controller has no authorization context (e.g., organization membership) to allow login. Option B correctly identifies this missing organization mapping as the most likely cause.

Answer

The user is not a member of the required LDAP group that is mapped to a team.

Answer

The controller is case-sensitive and the user entered username in wrong case.

Answer

The LDAP server is configured to use TLS, but the controller uses SAML.

Question 18

Which TWO are valid methods to back up an Ansible Automation Controller installation? (Choose two.)

Accepted Answer

Perform a `pg_dump` of the PostgreSQL database and copy `/var/lib/awx` files.. Option A is correct because a supported manual backup of Ansible Automation Controller consists of dumping the PostgreSQL database (e.g., with pg_dump) and copying the file-based data under /var/lib/awx, which together capture the controller's configuration and content. Option D is correct because the installer bundle provides ./setup.sh -b (backup) to perform a full backup of the Automation Controller installation, including the database and relevant files. Option B is not valid because there is no controller UI feature that exports configuration via a dumpconfig command. Option C is not valid because awx-manage backup is not a real awx-manage subcommand for backing up the controller. Option E is not valid because invoke-rc.d automation-controller backup is not a supported backup method for the Automation Controller service.

Answer

Use the controller UI to export configuration via `dumpconfig`.

Answer

Execute `awx-manage backup` on the controller node.

Answer

Use `invoke-rc.d automation-controller backup`

Question 19

Which TWO should be configured to enable centralized logging from multiple Automation Controller nodes to an external Elasticsearch cluster? (Choose two.)

Accepted Answer

Configure a logging aggregator in the controller's system settings to point to the Elasticsearch endpoint.. Option D is correct because Automation Controller's centralized logging feature is enabled by configuring an external logging aggregator (the Elasticsearch endpoint, port, and credentials) in the controller's system settings, which then ships controller and job logs to that cluster. Option E is correct because enabling the CALLBACK_RECEIVER log level ensures callback-related log messages are generated and included in the aggregated log stream sent to Elasticsearch, which is required for complete centralized logging of callback events. Option A is not correct because logrotate manages local log rotation and retention; it does not forward logs to an external Elasticsearch cluster. Option B is not correct because rsyslog forwarding to Elasticsearch is not the supported mechanism for Automation Controller centralized logging, and it does not handle the controller's structured application logs. Option C is not correct because installing filebeat as a sidecar is not the built-in Automation Controller method for centralized logging; the supported approach uses the logging aggregator configuration.

Answer

Configure `logrotate` to ensure logs are not truncated before being sent.

Answer

Set up `rsyslog` on each node to forward application logs to Elasticsearch.

Answer

Install and configure `filebeat` on each controller node as a sidecar service.

Question 20

A junior administrator is deploying Ansible Automation Platform (AAP) 2.3 on a fresh RHEL 9 server. They have downloaded the installer and edited the inventory file. The installation fails early in the process with: `TASK [private_automation_hub : Check that server_url has been configured]` and the error message: `FAILED - Could not connect to the Automation Hub server`. The inventory file has the following relevant lines: `automationhub_server_url=https://hub.example.com:443` and `automationhub_validate_certs=false`. The server `hub.example.com` is reachable from the installation node and responds with a 404 on the root path. The admin verified that the SSL certificate is self-signed. What should the admin do to resolve the issue?

Accepted Answer

Set `automationhub_server_url=https://hub.example.com/api/galaxy` to match the expected API path.. The Automation Hub server URL must point to the API endpoint, not the root path. The installer's `private_automation_hub` role checks for a valid response from `automationhub_server_url/api/galaxy/content/`, and a 404 on the root indicates the server is running but the URL is misconfigured. Setting the URL to `https://hub.example.com/api/galaxy` aligns with the expected API path, allowing the connectivity check to succeed.

Answer

Ensure that the hostname resolves to the correct IP address.

Answer

Add an `automationhub_token` value from the hub server.

Answer

Set `automationhub_validate_certs=true` and provide a CA certificate bundle.