EX294 Deploy Ansible Automation Platform Practice Test 4 — 15 Questions

Question 1

Drag and drop the steps to configure a basic NFS server to export a directory in the correct order.

Accepted Answer

Install NFS packages, create directory, configure /etc/exports, start NFS service, verify export. To configure a basic NFS server to export a directory, the correct sequence is: install the NFS packages (e.g., nfs-utils), create the directory to be shared, edit /etc/exports to define the export, start and enable the NFS server service, and finally verify the export using 'showmount -e localhost'. This workflow ensures that all prerequisites are met before each step, avoiding errors such as missing directories or unapplied configuration.

Answer

Install NFS packages, create directory, start NFS service, configure /etc/exports, verify export

Answer

Create directory, install NFS packages, configure /etc/exports, start NFS service, verify export

Answer

Install NFS packages, configure /etc/exports, create directory, start NFS service, verify export

Question 2

Match each Ansible module to its primary function.

Accepted Answer

yum: Manages packages using the yum package manager. The yum module manages packages, service manages system services, and copy transfers files from local to remote. Common confusions include swapping definitions or using the wrong direction for file transfers.

Answer

yum: Manages services (start, stop, restart, enable)

Answer

service: Manages packages using the yum package manager

Answer

copy: Copies files from remote to local hosts

Question 3

Match each Ansible inventory parameter to its meaning.

Accepted Answer

ansible_host: The hostname or IP address to connect to.. Common Ansible inventory parameters: ansible_host defines target host, ansible_port defines SSH port, ansible_user defines remote user, ansible_ssh_private_key_file defines SSH key. Be careful not to confuse them with ansible_connection or ansible_become.

Answer

ansible_host: The connection type (e.g., ssh, winrm).

Answer

ansible_port: The method to become a different user (e.g., sudo).

Question 4

An organization is deploying Automation Platform for the first time. The security team requires that all SSH private keys used for automation be stored securely with access controls. Which AAP feature should be used to meet this requirement?

Accepted Answer

Create a Machine credential type and upload the SSH private key.. The Machine credential type in Ansible Automation Platform (AAP) is specifically designed to securely store SSH private keys. When you upload the private key via the AAP web UI or API, it is encrypted at rest in the AAP database and access is controlled through role-based access control (RBAC). This meets the security team's requirement for secure storage and access controls without exposing the key in plain text.

Answer

Store the private key in plain text within the inventory file.

Answer

Use Ansible Vault to encrypt the private key file.

Answer

Set the SSH key as an environment variable on the controller.

Question 5

An admin is configuring a project in Automation Platform to pull playbooks from a Git repository. Which source control type should be selected?

Accepted Answer

SCM. (SCM) is correct because Ansible Automation Platform uses Source Control Management (SCM) to integrate with Git repositories. When configuring a project, selecting 'SCM' allows the platform to pull playbooks, roles, and inventories directly from a remote Git repository, enabling version control and automated sync.

Answer

Local

Answer

Manual

Answer

Red Hat Insights

Question 6

An organization is designing a high-availability Automation Platform deployment. Which TWO practices are essential for achieving high availability?

Accepted Answer

Deploy multiple automation controllers behind a load balancer.. Option C is correct because deploying multiple automation controllers behind a load balancer eliminates a single point of failure for the control plane, allowing traffic to be redistributed if one controller node becomes unavailable, which is fundamental to high availability. Option E is correct because using an external PostgreSQL database with replication ensures the shared data layer (job history, credentials metadata, inventories, etc.) remains available even if a database node fails, and externalizing it also decouples database lifecycle from controller nodes. Option A is incorrect because a single PostgreSQL instance on the controller node creates a single point of failure and couples the database to that node, undermining HA. Option B is incorrect because consolidating everything on one powerful node still leaves a single point of failure regardless of performance. Option D is incorrect because storing secrets in the Automation Platform vault is a security best practice for credential management, not a high-availability mechanism.

Answer

Use a single instance of PostgreSQL on the controller node.

Answer

Installation on a single powerful node.

Answer

Store all secrets in the Automation Platform vault.

Question 7

An admin attempts to run this playbook as a job template in AAP. The job fails with 'ERROR! 'now' is not a valid attribute for a task'. What is the issue?

Accepted Answer

The 'now' attribute does not exist; it may be a typo for 'notify' or should be removed.. The error message 'ERROR! 'now' is not a valid attribute for a task' indicates that Ansible does not recognize 'now' as a valid task attribute. The 'now' keyword is not a standard Ansible directive; it is likely a typo for 'notify' (used with handlers) or should be removed entirely. Ansible validates task attributes against a strict schema, and any unknown attribute causes a parsing failure.

Answer

The template task is missing quotes around the file paths.

Answer

The playbook has an incorrect indentation in the tasks block.

Answer

The 'become' directive is placed incorrectly at the play level.

Question 8

An admin imports this inventory into AAP and assigns a machine credential that uses SSH key authentication. The job fails with 'Authentication failed'. What is the most likely cause?

Accepted Answer

The machine credential does not contain an SSH private key.. In Red Hat Ansible Automation Platform (AAP), when a machine credential is assigned to a host, that credential's SSH key is used for authentication. If the credential does not contain an SSH private key, authentication will fail. Credentials take precedence over inventory variables such as ansible_ssh_private_key_file, so a conflict is not the likely cause. Therefore, the most likely cause is that the machine credential is missing its SSH private key.

Answer

The private key file path in the inventory does not exist on the controller.

Answer

The credential's SSH key is not being used because the inventory variable ansible_ssh_private_key_file conflicts.

Answer

The 'ansible_become' variable is missing from the inventory.

Question 9

An admin needs to restrict which users can launch specific job templates. Which AAP feature should be used?

Accepted Answer

Role-based access control (RBAC) on job templates.. Role-based access control (RBAC) on job templates is the correct feature because it allows an administrator to assign specific permissions (e.g., execute, read, or admin) to users or teams for individual job templates in Ansible Automation Platform (AAP). This directly restricts which users can launch specific job templates without affecting other resources.

Answer

Execution environments with custom modules.

Answer

Machine credentials with different users.

Answer

Inventory groups with host restrictions.

Question 10

A job template runs successfully on some hosts but fails on others with 'Permission denied' for the same task. The admin has verified that the credential is correct. What is the most likely cause?

Accepted Answer

The privilege escalation method (become method) differs among hosts.. B is correct because the 'Permission denied' error on a task that runs successfully on some hosts but not others, despite a verified credential, typically indicates a privilege escalation issue. The become method (e.g., sudo, su, pbrun) may be configured differently or unsupported on the failing hosts, causing Ansible to fail when attempting to escalate privileges for the task. Since the credential is correct, the failure occurs during the become process, not authentication.

Answer

The package repository is not accessible from those hosts.

Answer

The credential's username is incorrect for some hosts.

Answer

The SSH key is not accepted on some hosts.

Question 11

An admin configures an automation mesh environment. What is the primary purpose of mesh nodes in AAP?

Accepted Answer

To scale automation execution capacity.. Mesh nodes in Ansible Automation Platform (AAP) are designed to distribute automation execution workloads across multiple nodes, enabling horizontal scaling. They do not handle the web UI, controller logic, or database functions; instead, they execute playbooks and jobs, offloading work from the automation controller to increase overall capacity and performance.

Answer

To enable high availability for the web UI.

Answer

To act as a backup for the automation controller.

Answer

To provide a redundant database server.

Question 12

A team uses execution environments (EE) for job templates. The admin builds a custom EE using `ansible-builder` with a `execution-environment.yml` file that includes a `base_image: registry.redhat.io/ansible-automation-platform-21/ee-minimal-rhel8:latest` and a custom Python requirement. However, the controller reports that the EE is not found when launching a job. What is the most likely issue?

Accepted Answer

The built EE image was not pushed to the container registry specified in the controller's execution environment configuration.. After building a custom execution environment with `ansible-builder`, the resulting container image must be pushed to a container registry that the Automation Controller is configured to access. The controller does not automatically pull images from the local build cache; it references the image by its registry path. If the image is not present in the specified registry, the controller will report that the EE is not found when launching a job.

Answer

The base image is pointing to an incorrect registry path.

Answer

The custom Python requirement needs to be added to `requirements.txt` in the project.

Answer

The execution environment does not include a `Containerfile` for the build process.

Question 13

Which THREE are valid user roles within an Automation Controller organization? (Choose three.)

Accepted Answer

Organization auditor. In Automation Controller (Ansible Tower), an organization defines a set of users, teams, and resources, and it grants three built-in user roles: Organization admin, Organization member, and Organization auditor. Option B (Organization admin) is correct because this role has full administrative rights over the organization, including managing users, teams, projects, inventories, and credentials within it. Option E (Organization member) is correct because this role grants standard access to use the organization's resources, such as running job templates, without administrative privileges. Option A (Organization auditor) is correct because this role provides read-only visibility into the organization's objects and activity for auditing purposes. Option C (Organization team_member) is not a valid organization-level role; team membership is a separate association, and roles like member/admin are assigned to teams rather than being an organization role itself. Option D (Superuser) is a system-wide role that sits above organizations and is not one of the organization-scoped user roles.

Answer

Organization team_member

Answer

Superuser

Question 14

A company is deploying Ansible Automation Platform (AAP) in a three-node cluster: one automation controller node, one private automation hub node, and one database node (PostgreSQL). The deployment uses an execution environment that pulls from the private automation hub. After a successful installation, all nodes are reachable and services are running. However, when launching a job template that uses the execution environment, the job fails with the error: 'Unable to pull execution environment image from automation-hub.example.com:5000/ee/my-ee:latest - request to registry failed with status 403 Forbidden'. The administrator confirms that the execution environment image exists in the private automation hub and that the automation controller node can reach the registry via curl. What is the most likely cause and solution?

Accepted Answer

Create a container registry credential in automation controller that uses the pull token from private automation hub, and associate it with the execution environment.. The 403 Forbidden error indicates that the automation controller cannot authenticate to the private automation hub container registry. Even though the image exists and network connectivity works, the controller needs a container registry credential configured with the pull token from the private automation hub. This credential must be associated with the execution environment. Option A is wrong because disabling authentication compromises security and is not the intended solution. Option B is wrong because SELinux would produce a different error (e.g., permission denied), not a 403. Option D is wrong because the 'pull' field does not affect authentication; the error is about authentication, not pull policy.

Answer

The private automation hub is configured to allow unauthenticated access; change the hub configuration to disable authentication.

Answer

SELinux on the controller node is blocking container pulls; temporarily set SELinux to permissive.

Answer

The execution environment definition in the controller is missing the 'pull' field; add 'pull: always' to the job template.

Question 15

An administrator is deploying Ansible Automation Platform 2.4 on a RHEL 9 server. They have downloaded the bundled installer tarball and extracted it. Which file must be edited to specify the PostgreSQL admin password, the automation controller admin password, and the receptor connection settings before running the setup script?

Accepted Answer

inventory. The AAP bundled installer reads all deployment variables, including database and admin passwords plus receptor settings, from the inventory file. Editing that file before executing setup.sh is the supported method. Configuration files like ansible.cfg and legacy paths are not consulted for these values, and altering the installer script itself is unsupported.

Answer

setup.sh

Answer

ansible.cfg

Answer

/etc/tower/conf.d/credentials.py