EX294 Transform data with filters and plugins — 50 Questions

Question 1

An Ansible playbook needs to extract the first line from a multi-line string variable 'output' and store it in a new variable 'first_line'. Which filter should be used?

Accepted Answer

{{ output | split('
') | first }}. The `split('
')` filter splits the multi-line string into a list of lines, and the `first` filter extracts the first element. This is the standard Ansible approach to isolate the first line from a string variable.

Answer

Answer

Answer

Question 2

A playbook uses the 'uri' module to query an API and registers the result. The API returns a JSON with a nested field 'data.users[0].name'. Which expression correctly extracts that name?

Accepted Answer

{{ result | json_query("data.users[0].name") }}. Options B and D are both correct because the `json_query` filter accepts JMESPath queries quoted with either single or double quotes. Both `'data.users[0].name'` and `"data.users[0].name"` are syntactically valid in Ansible Jinja2 expressions. The `uri` module parses JSON response into a dictionary, so `result` is the top-level object, and the JMESPath query correctly extracts the nested field. Option C is incorrect because it uses native Jinja2 dot notation, which would only work if `result` were already a deeply nested dictionary, but the registered object may still contain headers and other HTTP metadata. Option A is incorrect because JMESPath uses zero-based index without the dot notation, i.e., `users[0]`, not `users.0`.

Answer

Answer

Question 3

A team is migrating from static inventory to dynamic inventory using a custom script. The script returns JSON with a group 'webservers' containing hosts. However, the playbook targeting 'webservers' fails with 'no hosts matched'. Which filter or plugin issue is most likely?

Accepted Answer

The script output is missing the '_meta' key with 'hostvars'.. Dynamic inventory scripts must include a `_meta` key with `hostvars` in their JSON output for Ansible to properly resolve host variables and match hosts to groups. Without `_meta`, Ansible cannot associate host-specific variables (like `ansible_host`) with the hosts listed under `webservers`, causing the playbook to see no matched hosts even though the group exists.

Answer

The playbook uses 'hosts: all' but should use 'hosts: webservers'.

Answer

The script is not executable.

Answer

The 'ansible_host' variable is not set in hostvars.

Question 4

A playbook uses the 'debug' module to print a variable 'myvar' which is a list of dictionaries. The output shows 'VARIABLE IS UNDEFINED' despite the variable being defined earlier. Which filter issue is most likely?

Accepted Answer

The variable is defined in a role but the playbook uses include_role incorrectly.. When a variable is defined inside a role but the playbook uses `include_role` incorrectly (e.g., without `tasks_from` or with a static import instead of dynamic include), the variable may not be available in the play's variable scope. The `debug` module then reports 'VARIABLE IS UNDEFINED' because the variable was never loaded into the play's namespace. This is a common scoping issue with role variables and dynamic includes.

Answer

The debug task uses 'var: myvar' instead of 'msg: "{{ myvar }}"'.

Answer

The playbook uses 'set_fact' with quotes around the variable name.

Answer

The variable contains a fact that is only available on the control node.

Question 5

Which TWO filters are used to transform data types in Ansible?

Accepted Answer

bool. In Ansible, the Jinja2-based filters used to transform values into specific data types include bool and int, which are explicitly provided by Ansible's filter plugins. Option B (bool) is correct because the bool filter converts a value (such as 'yes', 'true', '1', or 'on') into a Python boolean, which is essential for type coercion in playbooks. Option E (int) is correct because the int filter casts a value to an integer, commonly used to ensure numeric comparisons or arithmetic work correctly. Options A (list), C (float), and D (string) are not the two filters Ansible documents for data type transformation in this context; while Ansible does have a string filter and can produce lists, the canonical type-conversion filters tested here are bool and int.

Answer

list

Answer

float

Answer

string

Question 6

Which THREE plugins are used for data transformation in Ansible?

Accepted Answer

lookup. In Ansible, data transformation is handled by plugins that manipulate or retrieve data rather than control execution flow. Option B, lookup, is correct because lookup plugins fetch data from external sources (files, env, password stores) and return it for use in playbooks, effectively transforming external data into usable variables. Option C, filter, is correct because filter plugins transform data values inside Jinja2 expressions (e.g., map, select, regex_replace), which is the core mechanism for data transformation in templates and tasks. Option E, cache, is correct because cache plugins store and retrieve fact data across runs, transforming persisted data into reusable facts for subsequent playbook executions. Option A, connection, is not for data transformation; connection plugins define how Ansible communicates with managed hosts (ssh, winrm, docker, etc.). Option D, callback, is not for data transformation; callback plugins hook into events to control output/logging and do not transform playbook data.

Answer

connection

Answer

callback

Question 7

The debug output shows 'changed' even when the firewall rule already existed. Which filter issue could cause this?

Accepted Answer

The task should use 'immediate: yes' to reload the firewall, otherwise the module always reports changed.. C is correct because the `firewalld` module in Ansible, by default, operates in 'offline' mode (immediate: no), meaning it only modifies the permanent configuration without applying changes to the running runtime firewall. Even if a rule already exists in the permanent configuration, the module will report 'changed' because it still attempts to add the rule to the runtime zone unless `immediate: yes` is explicitly set to reload the firewall and synchronize the runtime state. This behavior is specific to how `firewalld` separates permanent and runtime rule sets.

Answer

The 'changed' key is misspelled as 'change' in the filter.

Answer

The variable 'fw_result' is undefined because the task failed.

Answer

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Question 8

Your organization manages a fleet of 500 web servers running RHEL 8. Each server has a custom fact file /etc/ansible/facts.d/web.fact containing:
[web]
docroot=/var/www/html
port=80
admin=admin@example.com

You have a playbook that needs to configure the firewall to allow traffic on the port defined in the custom fact for each server. The playbook uses the 'ansible_local' variable to access these facts. However, some servers have the custom fact file missing or malformed. The task to open the firewall port fails on those servers with 'VARIABLE IS UNDEFINED'. You need to implement a solution that handles missing custom facts gracefully, setting a default port of 8080 if the fact is not defined, and still log a warning. Which approach should you take?

Accepted Answer

Use a 'set_fact' task with 'port: "{{ ansible_local.web.port | default(8080) }}"' and add a 'debug' task with 'when: ansible_local.web.port is undefined' to warn.. It uses the `default` filter to gracefully handle undefined variables, setting a fallback port of 8080 when the custom fact is missing or malformed. The additional `debug` task with `when: ansible_local.web.port is undefined` provides a warning without causing the playbook to fail. This approach aligns with the EX294 objective of transforming data with filters and plugins, specifically using Jinja2 filters to manage missing data.

Answer

Use 'ignore_errors: yes' on the firewall task and then check the result with 'failed_when' to set a default.

Answer

Use 'block' and 'rescue' to catch the error and then set the fact.

Answer

Create a separate playbook for servers without the fact file, running a different role.

Question 9

An Ansible playbook needs to generate a list of IP addresses from a range 192.168.1.10 to 192.168.1.20. Which filter should be used in a Jinja2 template?

Accepted Answer

{{ '192.168.1.10-20' | ipaddr('range_include') }}. The `ipaddr` filter with the `'range_include'` parameter generates a list of all IP addresses within a specified range, including both endpoints. In this case, `'192.168.1.10-20' | ipaddr('range_include')` produces a list from 192.168.1.10 through 192.168.1.20, which is exactly what the playbook needs to generate.

Answer

Answer

Answer

Question 10

An Ansible playbook retrieves a list of dictionaries from an API. Each dictionary has keys 'name', 'status', and 'zone'. The playbook needs to filter out entries where 'status' is 'inactive' and then extract only the 'name' values. Which THREE of the following combinations of filters and loops would achieve this?

Accepted Answer

{{ data | rejectattr('status', 'equalto', 'inactive') | map(attribute='name') | list }}. Option A is correct because rejectattr('status', 'equalto', 'inactive') removes every dictionary whose status equals 'inactive', and map(attribute='name') then extracts the name values into a list. Option C is correct because the Jinja2 for-loop with the inline condition 'if item.status != 'inactive'' iterates only over entries whose status is not inactive and prints each item.name. Option D is correct because selectattr('status', 'equalto', 'active') keeps only entries with status 'active', which is the complement of 'inactive' in this data, and map(attribute='name') extracts the names. Option B is incorrect because Jinja2 has no 'extract' filter; the correct filter for pulling a dictionary key is map(attribute='name'). Option E is incorrect because selectattr requires a test name and argument (e.g., 'equalto', 'inactive'), not a raw expression string like 'status != inactive'.

Answer

{{ data | rejectattr('status', 'equalto', 'inactive') | extract('name') | list }}

Answer

{{ data | selectattr('status != inactive') | map(attribute='name') | list }}

Question 11

You are maintaining an Ansible automation for a large Red Hat Enterprise Linux deployment. The playbook configures NTP servers on all managed nodes. It uses a variable 'ntp_servers' defined in group_vars/all.yml as a list: ['0.rhel.pool.ntp.org', '1.rhel.pool.ntp.org', '2.rhel.pool.ntp.org']. The playbook task uses the 'uri' module to test connectivity to each server, but only if the server is reachable. The task currently uses:

```
- name: Test NTP server reachability
  uri:
    url: "http://{{ item }}:123"
    timeout: 5
  register: result
  loop: "{{ ntp_servers }}"
  until: result.status == 200
  retries: 3
  delay: 2
```

However, the playbook fails because the NTP servers do not respond to HTTP on port 123. You need to change the approach to test ICMP reachability using the 'ping' module, but the 'ping' module does not support a custom destination port. You also want to continue using a loop and register the success/failure per server. Which of the following is the best course of action?

Accepted Answer

Replace the task with the 'command' module to run 'ping -c 1 {{ item }}' and register results, using 'ignore_errors' to handle unreachable servers.. The 'ping' module in Ansible does not support custom ports or protocols, and NTP servers do not respond to HTTP on port 123. Using the 'command' module to run 'ping -c 1' allows ICMP reachability testing, and 'ignore_errors' prevents playbook failure when a server is unreachable, while still registering per-server success/failure via the loop.

Answer

Use the 'slurp' module to read the /etc/hosts file and check if the server is listed.

Answer

Use the 'wait_for' module with 'host={{ item }}' and 'port=123' to test connectivity, since NTP uses UDP 123.

Answer

Use the 'ping' module with a loop over the ntp_servers list, setting the 'data' parameter to the server IP.

Question 12

When using the 'uri' module to interact with a REST API in Ansible, which TWO of the following statements about error handling and response parsing are correct?

Accepted Answer

To access the response body, use the 'body' key of the registered variable and then parse it with a filter like 'json_query'.. Option B is correct because the uri module returns the raw response content under the 'body' key of the registered variable, and since it is a string, you must parse it with a filter such as 'json_query' (or 'from_json') to work with the JSON data. Option C is correct because the uri module's 'status_code' parameter lets you specify which HTTP status codes should be treated as successful, overriding the default of 200. Option A is incorrect because 'follow_redirects' controls whether 3xx redirects are followed (values like 'all', 'none', 'safe', 'urllib2'), not 4xx/5xx error handling. Option D is incorrect because 'failed_when' evaluates after the request completes, not before it is sent. Option E is incorrect because the 'register' keyword only stores the module's result; it does not automatically parse JSON into variables.

Answer

The 'follow_redirects' parameter must be set to 'all' to handle HTTP 4xx and 5xx errors gracefully.

Answer

The 'failed_when' condition can inspect the HTTP response before the request is sent.

Answer

The 'register' keyword automatically parses JSON responses into Ansible variables.

Question 13

Refer to the exhibit. After running the playbook, the 'content' field contains an HTML page. The team wants to extract the text inside the

tags using Ansible filters. Which of the following tasks correctly extracts the content of the

element?

Accepted Answer

set_fact: heading="{{ result.content | regex_replace('.*

(.*)

.*', '\1') }}". It uses `regex_replace` with a pattern that matches the entire string (`.*

(.*)

.*`) and replaces it with the captured group `\1`, effectively extracting only the heading text. Option B, while it uses `regex_replace`, only matches the `

...

` portion; if the page contains any content outside the `

` tags, that content remains, so it does not reliably extract just the heading text. Options C and D return the full match including the tags, not just the inner text.

Answer

set_fact: heading="{{ result.content | regex_replace('

(.*)

', '\1') }}"

Answer

set_fact: heading="{{ result.content | regex_search('

(.*)

') }}"

Answer

set_fact: heading="{{ result.content | regex_findall('

(.*)

') | first }}"

Question 14

You are managing a fleet of 200 RHEL 8 servers with Ansible Tower. A playbook uses the 'seboolean' module to enable httpd_can_network_connect for a web application. Recently, the playbook has been failing on 10 servers with the error: 'Failed to set SELinux boolean: Unable to communicate with SELinux policy'. Other servers succeed. The playbook runs as the 'ansible' user with passwordless sudo. The failing servers have identical SELinux configuration (enforcing mode, targeted policy) and the same package versions as working servers. You suspect the issue is related to the 'python3-libselinux' package. Which of the following is the most likely cause and the correct fix?

Accepted Answer

The 'python3-libselinux' package is missing on the failing servers. Install it with 'dnf install python3-libselinux'.. The error 'Failed to set SELinux boolean: Unable to communicate with SELinux policy' indicates that the Python bindings required to interact with the SELinux policy are missing. The 'seboolean' module in Ansible relies on the 'python3-libselinux' package to communicate with the SELinux subsystem. Since the playbook runs as the 'ansible' user with passwordless sudo, and the failing servers have identical SELinux configuration and package versions except for this missing dependency, installing 'python3-libselinux' resolves the issue.

Answer

The 'python2-libselinux' package is required because Ansible uses Python 2. Install it with 'dnf install python2-libselinux'.

Answer

The 'ansible' user lacks sudo access to the 'seboolean' command. Add a sudoers entry to allow it.

Answer

The 'libsemanage' package is missing. Install it with 'dnf install libsemanage'.

Question 15

Match each SELinux context component to its meaning.

Accepted Answer

user: The SELinux user identity that defines which roles a user can enter.. The SELinux security context consists of user:role:type:level. User identifies the SELinux user, role defines allowed types via RBAC, type is for Type Enforcement, and level for MLS/MCS. Common confusions include mistaking user for process attributes or role for hardware.

Answer

user: The component that specifies the process's current working directory.

Answer

role: The component that defines the hardware architecture.

Question 16

Which filter converts a string like 'hello' into a list of characters ['h','e','l','l','o']?

Accepted Answer

`list`. The `list` filter in Ansible converts a string into a list of its individual characters by iterating over the string and creating a list where each element is a single character. This is a built-in Jinja2 filter that works directly on strings, making option A correct for transforming 'hello' into ['h','e','l','l','o'].

Answer

`split`

Answer

`join`

Answer

`map`

Question 17

What does the `| quote` filter do in an Ansible task?

Accepted Answer

It escapes shell metacharacters to prevent shell injection.. The `| quote` filter in Ansible is designed to escape shell metacharacters (e.g., spaces, semicolons, backticks, dollar signs) in a string, ensuring that the value is safely passed to a shell command without risk of shell injection. This is critical when using variables in `command` or `shell` modules where user-supplied data could otherwise break the command or introduce security vulnerabilities.

Answer

It converts the string to uppercase.

Answer

It returns the string wrapped in double quotes.

Answer

It encodes the string for use in URLs.

Question 18

Which lookup plugin is used to retrieve values from an AWS SSM Parameter Store?

Accepted Answer

`aws_ssm`. The `aws_ssm` lookup plugin is the correct choice because it is the official Ansible lookup plugin designed to retrieve values from the AWS Systems Manager Parameter Store. It is part of the `amazon.aws` collection and is invoked via `lookup('aws_ssm', 'parameter_name')` in playbooks.

Answer

`ssm`

Answer

`amazon_ssm`

Answer

`ssm_parameter`

Question 19

You run a playbook with `msg: "{{ 'mypassword' | password_hash('sha512') }}"`. What is the output?

Accepted Answer

A hashed representation of the password using SHA-512.. The `password_hash` filter in Ansible uses the `passlib` library (when available) to generate a cryptographically hashed representation of the input string. When the hash type is specified as `'sha512'`, it produces a SHA-512 crypt hash (typically starting with `$6$`), not the original plaintext. This is a standard Ansible filter for securely transforming passwords into hashed formats for use in user modules or configuration files.

Answer

An error because password_hash requires the `passlib` library.

Answer

A random alphanumeric string.

Answer

The string 'mypassword' unchanged.

Question 20

You have two dictionaries: `dict1: {a: 1, b: 2}` and `dict2: {b: 3, c: 4}`. You want a new dict that combines both, with `dict2` values taking precedence for overlapping keys. Which filter chain achieves this?

Accepted Answer

`dict2 | combine(dict1, recursive=True)`. With recursive=True, the combine filter performs a deep merge where the left-hand operand (dict2) retains its values for overlapping keys when combined with dict1. This satisfies the requirement that dict2 values take precedence for the overlapping key 'b', resulting in {a: 1, b: 3, c: 4}.

Answer

`dict2 | combine(dict1)`

Answer

`[dict1, dict2] | combine`

Answer

`dict1 | combine(dict2)`