EX294 Deploy Ansible Automation Platform Practice Test 2 — 15 Questions

Question 1

An administrator is designing a workflow that includes an approval node. The workflow should pause at the approval node until a user with the appropriate role approves or denies. The workflow is triggered by a webhook. After setting up, the webhook successfully starts the workflow, but the approval node is never created. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The workflow job template is set to run as a system user, but the approval node requires an actual user to approve.. In Ansible Automation Platform, approval nodes in workflows require a real user to approve or deny the request. If the workflow job template is configured to run as a system user (e.g., the automation controller system user), there is no actual user identity associated with the approval action, so the approval node is never created. The webhook can still trigger the workflow, but the approval node fails to materialize because the system user lacks the necessary user context to generate the approval request.

Answer

The approval node requires a notification template to be configured.

Answer

The approval node's timeout is set to 0, causing it to be skipped.

Answer

The inventory for the workflow does not have proper machine credentials.

Question 2

A user wants to authenticate against Ansible Automation Controller using LDAP. They configure the LDAP settings in the controller UI. After saving, they test the connection and it succeeds. However, when an LDAP user tries to log in, they get an authentication failure. What is the most likely issue?

Accepted Answer

The user has not been mapped to an organization within the LDAP configuration.. In Ansible Automation Controller, LDAP users must be explicitly mapped to an organization within the LDAP configuration. Without this mapping, the user is authenticated by the LDAP server but the controller has no authorization context (e.g., organization membership) to allow login. Option B correctly identifies this missing organization mapping as the most likely cause.

Answer

The user is not a member of the required LDAP group that is mapped to a team.

Answer

The controller is case-sensitive and the user entered username in wrong case.

Answer

The LDAP server is configured to use TLS, but the controller uses SAML.

Question 3

Which TWO are valid methods to back up an Ansible Automation Controller installation? (Choose two.)

Accepted Answer

Perform a `pg_dump` of the PostgreSQL database and copy `/var/lib/awx` files.. Option A is correct because a supported manual backup of Ansible Automation Controller consists of dumping the PostgreSQL database (e.g., with pg_dump) and copying the file-based data under /var/lib/awx, which together capture the controller's configuration and content. Option D is correct because the installer bundle provides ./setup.sh -b (backup) to perform a full backup of the Automation Controller installation, including the database and relevant files. Option B is not valid because there is no controller UI feature that exports configuration via a dumpconfig command. Option C is not valid because awx-manage backup is not a real awx-manage subcommand for backing up the controller. Option E is not valid because invoke-rc.d automation-controller backup is not a supported backup method for the Automation Controller service.

Answer

Use the controller UI to export configuration via `dumpconfig`.

Answer

Execute `awx-manage backup` on the controller node.

Answer

Use `invoke-rc.d automation-controller backup`

Question 4

Which TWO should be configured to enable centralized logging from multiple Automation Controller nodes to an external Elasticsearch cluster? (Choose two.)

Accepted Answer

Configure a logging aggregator in the controller's system settings to point to the Elasticsearch endpoint.. Option D is correct because Automation Controller's centralized logging feature is enabled by configuring an external logging aggregator (the Elasticsearch endpoint, port, and credentials) in the controller's system settings, which then ships controller and job logs to that cluster. Option E is correct because enabling the CALLBACK_RECEIVER log level ensures callback-related log messages are generated and included in the aggregated log stream sent to Elasticsearch, which is required for complete centralized logging of callback events. Option A is not correct because logrotate manages local log rotation and retention; it does not forward logs to an external Elasticsearch cluster. Option B is not correct because rsyslog forwarding to Elasticsearch is not the supported mechanism for Automation Controller centralized logging, and it does not handle the controller's structured application logs. Option C is not correct because installing filebeat as a sidecar is not the built-in Automation Controller method for centralized logging; the supported approach uses the logging aggregator configuration.

Answer

Configure `logrotate` to ensure logs are not truncated before being sent.

Answer

Set up `rsyslog` on each node to forward application logs to Elasticsearch.

Answer

Install and configure `filebeat` on each controller node as a sidecar service.

Question 5

A junior administrator is deploying Ansible Automation Platform (AAP) 2.3 on a fresh RHEL 9 server. They have downloaded the installer and edited the inventory file. The installation fails early in the process with: `TASK [private_automation_hub : Check that server_url has been configured]` and the error message: `FAILED - Could not connect to the Automation Hub server`. The inventory file has the following relevant lines: `automationhub_server_url=https://hub.example.com:443` and `automationhub_validate_certs=false`. The server `hub.example.com` is reachable from the installation node and responds with a 404 on the root path. The admin verified that the SSL certificate is self-signed. What should the admin do to resolve the issue?

Accepted Answer

Set `automationhub_server_url=https://hub.example.com/api/galaxy` to match the expected API path.. The Automation Hub server URL must point to the API endpoint, not the root path. The installer's `private_automation_hub` role checks for a valid response from `automationhub_server_url/api/galaxy/content/`, and a 404 on the root indicates the server is running but the URL is misconfigured. Setting the URL to `https://hub.example.com/api/galaxy` aligns with the expected API path, allowing the connectivity check to succeed.

Answer

Ensure that the hostname resolves to the correct IP address.

Answer

Add an `automationhub_token` value from the hub server.

Answer

Set `automationhub_validate_certs=true` and provide a CA certificate bundle.

Question 6

A team has been using Ansible Automation Controller for six months. They have a job template that runs a playbook against a static inventory. Recently, the job template started hanging indefinitely after launching. The admin checks the job output and sees: `PLAY [all] ************************` with no further output. The playbook uses `delegate_to: localhost` for some tasks. The admin executed the same playbook manually with `ansible-playbook` on the control node and it completes successfully. The controller logs show no errors. What is the most likely cause of the hang in the controller?

Accepted Answer

The execution environment used by the job template has no route to the controller's IP address on port 22.. In Ansible Automation Controller, job templates run inside an execution environment (container). When a playbook uses delegate_to: localhost, the task executes on the controller's execution node (the container itself), not on the inventory host. If the execution environment container has no network route to the controller's IP on port 22 (or the controller's hostname resolves incorrectly), the task hangs trying to connect. Manual ansible-playbook runs on the control node work because localhost is directly accessible.

Answer

The machine credential for the job template does not include the SSH key for the control node.

Answer

The playbook has a syntax error that only manifests when run as a job template.

Answer

The inventory for the job template does not include the control node host.

Question 7

An enterprise is running Ansible Automation Platform with automation mesh across three data centers. Each data center has a control node and multiple execution nodes. The mesh topology is set up with `node_type: control` for control nodes and `node_type: execution` for execution nodes. The nodes in DC2 can reach nodes in DC1 and DC3, but DC1 and DC3 cannot directly reach each other. The admin notices that jobs that require execution on DC3 are being scheduled on DC1 or DC2, causing slow performance. The admin checks the mesh node list and sees all nodes are healthy. What should the admin do to ensure jobs are executed geographically closest to the target nodes?

Accepted Answer

Configure `node_policy` to set `topology=dc3` on execution nodes in DC3 so the controller can route jobs based on proximity.. `node_policy` with `topology` allows administrators to define geographic or logical proximity hints for execution nodes. By setting `topology=dc3` on DC3 nodes, the automation controller can intelligently route jobs to the nearest available execution node, reducing latency without requiring direct network connectivity between DC1 and DC3.

Answer

Establish a direct VPN link between DC1 and DC3 to reduce latency.

Answer

Change the `node_type` of DC3 execution nodes to `control` to make them preferred.

Answer

Create host labels to tag nodes by data center and assign job templates accordingly.

Question 8

Which TWO statements are true about deploying Red Hat Ansible Automation Platform on a Red Hat Enterprise Linux 8 system?

Accepted Answer

The AAP installer uses an Ansible playbook named 'ansible-setup.yml' to perform the installation.. The correct answers are C and D. C is correct because the Red Hat Ansible Automation Platform installer is executed via an Ansible playbook named 'ansible-setup.yml' (or the setup.sh script that runs it). D is correct because automation controller and private automation hub are separate components that can be installed on different nodes to distribute the workload and improve scalability. Option A is incorrect because the admin user password is specified in the inventory file, not randomly generated. Option B is incorrect because in production environments, the database is typically installed on a separate node for performance and reliability. Option E is incorrect: while a valid subscription is required, attaching via subscription-manager is not mandatory; the installer can use local repositories or other subscription methods.

Answer

The installer automatically creates an admin user with a randomly generated password.

Answer

The automation controller and database must be installed on the same node for performance reasons.

Answer

Before installation, you must attach a subscription using subscription-manager attach --pool=...

Question 9

A junior admin runs the command shown in the exhibit. What is the most likely cause of the error?

Accepted Answer

The playbook uses incorrect YAML syntax; the task should use the 'module' keyword.. The error shown in the exhibit is a YAML syntax error: the task uses a module name (e.g., `shell`) directly as a key, but Ansible requires the `module` keyword to specify the module when using `ansible-navigator` or `ansible-playbook` with strict YAML parsing. The correct syntax is `module: shell` or using the module name as a top-level key only in older playbook formats, which `ansible-navigator` rejects.

Answer

The 'ansible.builtin' collection is not installed in the execution environment.

Answer

The shell module requires a command argument that is missing.

Answer

The playbook file path is incorrect; ansible-navigator cannot find the file.

Question 10

An administrator is deploying Red Hat Ansible Automation Platform 2.4 on a RHEL 9 control node. They extract the installer tarball and run `./setup.sh`. The installation fails with an error indicating that the database connection could not be established. The administrator confirms that PostgreSQL is installed and running locally. Which action should the administrator take to resolve the issue?

Accepted Answer

Define the `pg_password` variable in the inventory file with the correct database password.. The installer inventory file must include the `pg_password` variable to authenticate with the local PostgreSQL database. Without it, the installer cannot establish a connection, causing the failure. Other options either misconfigure the connection method or address unrelated issues. Ensuring the correct password is set is the direct and necessary fix.

Answer

Edit the inventory file to set `pg_host=''` to use the local Unix socket instead of TCP.

Answer

Disable SELinux on the control node before re-running the installer.

Answer

Install the `python3-psycopg2` package on the control node.

Question 11

An automation administrator is preparing a RHEL 9 control node for an Ansible Automation Platform 2.4 installation. The inventory file for the installer already contains the controller, hub, and database hosts. The administrator must supply credentials that the installer will use to connect to the managed nodes during deployment. Which file should the administrator edit to define the `ansible_password` variable for the managed nodes?

Accepted Answer

The `inventory` file in the installer directory, under the `[all:vars]` section. The AAP installer inventory file is the supported place to declare connection variables for the hosts being configured. Defining `ansible_user`, `ansible_password`, and privilege-escalation variables in the `[all:vars]` section ensures the setup playbooks can reach every managed node without prompting. Editing group_vars, ansible.cfg, or waiting for a generated credentials file all deviate from the documented installation procedure.

Answer

The `ansible.cfg` file in the installer directory, using the `remote_password` setting

Answer

The `group_vars/all` file inside the installer directory

Answer

The `credentials.yml` file created by the `setup.sh` script during the pre-flight check

Question 12

An administrator is preparing a RHEL 9 control node to install Ansible Automation Platform 2.4. They want to use an external PostgreSQL database instead of the bundled one. Which inventory variable must be set to point the installer to the external database?

Accepted Answer

`postgresql_host`. To use an external PostgreSQL database with the AAP installer, the inventory must specify `postgresql_host` along with credentials. This variable instructs the setup script to bypass the bundled database and connect to the external server. Using any other variable name will not be recognized, causing the installer to ignore the external database configuration.

Answer

`database_host`

Answer

`pg_host`

Answer

`db_host`

Question 13

An automation administrator is deploying Red Hat Ansible Automation Platform 2.5 and needs the controller to execute playbooks that require the community.general collection and its Python dependencies on the execution node. The administrator wants these requirements resolved automatically each time a job runs from a project. Where should the administrator define the collection and Python dependencies?

Accepted Answer

In the requirements.yml and requirements.txt files placed in the project's collections/ and root directories, referenced by the project.. Automation controller resolves project-level dependencies by reading requirements.yml for collections and requirements.txt for Python packages during project syncs. This makes the declared content available to execution environments automatically, matching the requirement to have dependencies resolved each time a job runs without manual image rebuilds.

Answer

In the job template's Variables field as a YAML dictionary mapping package names to versions.

Answer

In the execution environment definition file under the dependencies section, then rebuilt and pushed to the private automation hub.

Answer

In the ansible.cfg file inside /etc/ansible/ansible.cfg on the controller node, using the collections_paths directive.

Question 14

An administrator is configuring an Ansible Automation Platform 2.4 cluster with two automation controller nodes and one automation hub node. They want to ensure that the automation hub is highly available and that content collections are synchronized across all controller nodes. Which configuration step is required to achieve this?

Accepted Answer

Configure a shared PostgreSQL database and a shared filesystem for the automation hub, and ensure all controller nodes can reach the hub's API endpoint.. High availability for automation hub in AAP 2.4 requires a shared PostgreSQL database and a shared filesystem to allow multiple hub instances to serve the same content. Controller nodes then connect to the hub's API to synchronize collections. This setup ensures that if one hub instance fails, another can continue serving content, and all controllers have access to the same collections.

Answer

Set `automationhub_seed_collections` to 'true' and configure a remote repository in the automation hub.

Answer

Configure the `[automationhub]` group with multiple hosts and set `automationhub_authentication` to 'ldap'.

Answer

Configure the automation controller nodes to use the automation hub as a content source by setting `automationhub_main_url` and enabling `automationcontroller_use_automationhub`.

Question 15

An organization is deploying Ansible Automation Platform 2.4 in a production environment. The administrator must ensure the deployment is supported and secure. Which TWO actions are required before running the installer? (Choose two.)

Accepted Answer

Register the RHEL system with Red Hat Subscription Manager and enable the AAP repository.. Before running the AAP installer, the system must be registered with RHSM and the correct repository enabled, and the inventory must include credentials for accessing Red Hat's container registry. These steps ensure package and image availability. Disabling SELinux, specifying incorrect resource minimums, or setting up external DNS are not required and do not address the core prerequisites for a supported installation.

Answer

Disable SELinux permanently by setting it to permissive mode in `/etc/selinux/config`.

Answer

Ensure the control node has at least 4 GB of RAM and 20 GB of disk space for a minimal installation.

Answer

Install and configure an external DNS server for the AAP nodes.