EX294 Transform data with filters and plugins Practice Test 3 — 15 Questions

Question 1

A custom filter plugin named `custom_filter` is stored in `./filter_plugins/` relative to the playbook. The playbook runs on a control node where the `ansible.cfg` sets `filter_plugins = /opt/ansible/filters`. Which location will Ansible search for the plugin first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/opt/ansible/filters. Ansible's plugin loading order prioritizes the `filter_plugins` directory specified in `ansible.cfg` over the `./filter_plugins/` directory relative to the playbook. The `ansible.cfg` setting explicitly overrides the default search path, so `/opt/ansible/filters` is checked first.

Answer

Both A and B, with A first then B

Answer

./filter_plugins/

Answer

~/.ansible/plugins/filter

Question 2

Which THREE are valid uses of lookup plugins in Ansible? (Select exactly three.)

Accepted Answer

Generate a random MAC address using `password` lookup with `mac` parameter. Option A is correct because the `password` lookup plugin supports a `mac` parameter (e.g., `lookup('password', '/dev/null mac=...')`) that generates a random MAC address string, making it a valid use. Option B is correct because the primary purpose of the `password` lookup is to generate random passwords, optionally storing them in a file, which is a standard Ansible pattern. Option D is correct because the `ini` lookup plugin reads values from INI-formatted files by section and key, which is exactly its documented function. Option C is not valid because the `pipe` lookup executes commands on the control node (localhost), not on the remote host, so it cannot run commands remotely. Option E is not valid because there is no `file` lookup plugin in Ansible; reading file contents is done with the `file` lookup's actual counterpart, the `file` module or the `lookup('file', ...)` — but the option as stated misidentifies it, and the standard lookup for file contents is `file` only in the sense of the `file` lookup existing; however, since it is unmarked, it is excluded from the correct set.

Answer

Execute a command on the remote host using `pipe` lookup

Answer

Read the contents of a file using `file` lookup

Question 3

A company manages a large infrastructure of 10,000 servers using Ansible. The Ansible control node runs on a powerful machine with 32 cores and 64GB RAM. Recently, a playbook that processes server facts and generates a compliance report has become extremely slow, taking over 6 hours to complete. The playbook uses several `set_fact` tasks with complex jinja2 filters including `selectattr`, `map`, `json_query`, and `combine`. The inventory is stored in a dynamic inventory script that returns JSON. The team suspects that the filter operations are causing performance bottlenecks, especially when creating large data structures. A junior engineer suggests splitting the playbook into multiple plays and using `delegate_to` to distribute processing across managed nodes. Another suggests using the `ansible.builtin` module instead of filters. The senior architect recommends converting the heavy filter logic into a custom action plugin. What is the most effective approach to significantly reduce the execution time while maintaining functionality?

Accepted Answer

Convert the heavy filter logic into a custom Python action plugin that runs on the control node and performs data transformation efficiently.. Custom action plugins execute Python code directly on the control node, bypassing the Jinja2 templating engine entirely. This eliminates the overhead of parsing complex filters like `json_query` and `combine` for every host, which is the primary bottleneck when processing large data structures across 10,000 servers. Action plugins also have full access to Ansible's internal APIs, allowing efficient in-memory data transformations without the serialization/deserialization costs of `set_fact`.

Answer

Distribute the processing across managed nodes using `delegate_to` and loop over hosts.

Answer

Use `ansible.builtin` modules to replace filter operations; for example, use `add_host` and `group_by` to structure data.

Answer

Use `with_items` and `with_nested` loops instead of filters, as loops are faster.

Question 4

An Ansible playbook needs to parse a JSON output from a REST API and extract the value of a nested key "data.settings.timeout". The output is stored in the variable "api_result". Which filter should be used to safely extract the value, with a default of 30 if the key is missing or the JSON is malformed?

Accepted Answer

{{ api_result | json_query('data.settings.timeout') | default(30) }}. `json_query` uses JMESPath syntax to query nested JSON structures, and `data.settings.timeout` is a valid JMESPath expression for extracting the value at that nested key. The `default(30)` filter provides a fallback if the key is missing or the JSON is malformed, ensuring safe extraction.

Answer

{{ api_result | combine({'data.settings.timeout': 30}) }}

Answer

{{ api_result | selectattr('data.settings.timeout') | first | default(30) }}

Answer

{{ api_result | dict2items | selectattr('key', 'equalto', 'data.settings.timeout') | map(attribute='value') | first | default(30) }}

Question 5

A senior automation engineer is optimizing a playbook that processes large amounts of data. The playbook uses the "json_query" filter to filter and extract specific fields from a complex JSON structure returned by an API. The engineer notices that the playbook runs very slowly and consumes a lot of memory. They suspect the json_query filter is inefficient for this use case. The engineer wants to replace json_query with a combination of built-in Ansible filters to improve performance. The JSON structure is as follows:
{
  "servers": [
    {"name": "web01", "status": "active", "role": "web"},
    {"name": "web02", "status": "active", "role": "web"},
    {"name": "db01", "status": "active", "role": "db"}
  ]
}
The engineer needs to extract a list of server names where the status is "active" and the role is "web". The current code using json_query is:
server_names: "{{ api_result | json_query(\"servers[?status=='active' && role=='web'].name\") }}"
Which of the following alternatives uses only Ansible built-in filters (not json_query) and is likely to be more efficient?

Accepted Answer

server_names: "{{ api_result.servers | selectattr('status', '==', 'active') | selectattr('role', '==', 'web') | map(attribute='name') | list }}". It uses selectattr with '==' twice to filter servers where status equals 'active' and role equals 'web', then map to extract names. This approach uses only built-in Ansible filters and avoids JMESPath parsing, making it more efficient for large datasets. Option A uses rejectattr, which would exclude items that match the condition, thus returning the opposite set. Option B uses 'equalto', which is not a valid operator for selectattr. Option C uses 'is', which is also invalid.

Answer

server_names: "{{ api_result.servers | rejectattr('status', '==', 'active') | rejectattr('role', '==', 'web') | map(attribute='name') | list }}"

Answer

server_names: "{{ api_result.servers | selectattr('status', 'equalto', 'active') | selectattr('role', 'equalto', 'web') | map(attribute='name') | list }}"

Answer

server_names: "{{ api_result.servers | selectattr('status', 'is', 'active') | selectattr('role', 'is', 'web') | map(attribute='name') | list }}"

Question 6

An Ansible automation engineer is writing a playbook to configure network devices. They need to extract specific data from a JSON structure returned by an API call. Which two filters from the `ansible.utils` collection can be used to manipulate the data?

Accepted Answer

ipaddr. The `ipaddr` filter from `ansible.utils` is used to manipulate and validate IP addresses and network objects within a JSON structure, making it suitable for extracting specific network data from API responses. The `zip` filter combines lists element-wise into a list of tuples, which can help restructure data returned by an API for further processing. Both filters are part of the `ansible.utils` collection and directly support data manipulation tasks in Ansible playbooks.

Answer

to_json

Answer

json_query

Answer

from_json

Question 7

A playbook fails with an error when evaluating `{{ mylist | select('match') }}`. What is the most likely cause?

Accepted Answer

The `match` test requires a regex pattern as an argument.. The `match` test in Ansible always requires a regex pattern as an argument (e.g., `match('^foo')`). Without providing a pattern, the test has nothing to match against, and the playbook fails. Option C correctly identifies this as the cause. The other options are incorrect: `select` can be used without `selectattr` (A), quotes are not the issue (B), and `filter` plugin is not a substitute (D).

Answer

The `select` filter must be used with `selectattr` for attributes.

Answer

The `select` filter requires the test name without quotes.

Answer

The `filter` plugin should be used instead of `select`.

Question 8

A DevOps team uses Ansible to manage a large fleet of web servers. They have a custom filter plugin, `custom_encrypt`, stored in `/opt/ansible/filter_plugins/custom_encrypt.py`. This filter works correctly in Ansible 2.9. After upgrading the control node to Ansible 2.14 (ansible-core 2.14), the filter is no longer found. The `ansible.cfg` includes `filter_plugins = /opt/ansible/filter_plugins` and the file permissions are 644. The team verified the Python file is valid and contains the correct `FilterModule` class with a `filters()` method. Which of the following is the most likely cause of the issue?

Accepted Answer

The filter name used in playbooks does not match the name defined in the plugin's `filters()` method.. The most likely cause is that the filter name used in playbooks does not match the name defined in the plugin's `filters()` method. In Ansible, custom filter plugins must expose a `FilterModule` class with a `filters()` method that returns a dictionary mapping filter names to callables. If the playbook uses a filter name that is not a key in that dictionary, Ansible will not find it, resulting in a 'filter not found' error. This is a common issue after upgrades if the plugin's internal naming was changed or if the playbook references an outdated name.

Answer

The `ansible.cfg` path must be under `~/.ansible/plugins/filter_plugins`.

Answer

The filter plugin is missing a `filters()` method.

Answer

The filter plugin must be part of an Ansible collection because standalone filter plugins are deprecated.

Question 9

You are writing a playbook that must combine two dictionaries: `defaults` and `overrides`. The `overrides` dictionary should take precedence, but only for keys that already exist in `defaults`; any extra keys in `overrides` must be ignored. Which filter expression achieves this?

Accepted Answer

{{ defaults | combine(overrides | dict2items | selectattr('key', 'in', defaults) | items2dict) }}. To merge dictionaries while restricting the result to keys present in the base dictionary, you must filter the incoming dictionary's items before combining. Converting to items, using `selectattr` to keep only keys already in `defaults`, and converting back allows `combine` to apply overrides only where appropriate. This pattern is useful for configuration layering with strict schemas.

Answer

Answer

Answer

Question 10

You maintain a custom filter plugin in a collection that must be available to every playbook run from the project directory without editing ansible.cfg. The collection is installed locally under ./collections/ansible_collections/acme/tools. Which configuration ensures the plugin is discovered?

Accepted Answer

Define collections: [acme.tools] in the playbook and rely on the default collection search path.. Collections are the supported way to distribute filter plugins, and the collections keyword loads them for a play. Placing the collection under the project's ./collections directory makes it part of the default search path, so the plugin resolves by its fully qualified name without touching ansible.cfg or system directories.

Answer

Add the collection path to the DEFAULT_MODULE_PATH setting in ansible.cfg.

Answer

Copy the plugin file to /usr/share/ansible/plugins/filter and restart the control node.

Answer

Set ANSIBLE_FILTER_PLUGINS to the absolute path of the plugin file.

Question 11

A playbook registers the output of a shell command into a variable named result. The command writes a JSON document to stdout, but it also prints a leading log line before the JSON. You need to extract only the JSON object so later tasks can access result_json['status']. Which approach correctly parses the output?

Accepted Answer

Use result.stdout | regex_search('(\{.*\})', '\1') | first | from_json to isolate and parse the JSON object.. Parsing command output that contains non-JSON preamble requires isolating the JSON substring before deserialization. The regex_search filter can capture the JSON object from the mixed output, and from_json then converts that captured text into a usable dictionary. This lets later tasks reference the parsed status key reliably instead of treating the entire stdout as JSON.

Answer

Use result.stdout | json_query('status') to extract the status value directly.

Answer

Use result.stdout | from_json to parse the entire stdout.

Answer

Use result.stdout | to_json to convert the stdout into a dictionary.

Question 12

A task must transform a registered dictionary of application settings before passing it to a template. The team needs to extract only entries whose values are not empty and then produce a merged dictionary that overrides defaults with these settings. Which TWO filters are required to accomplish this transformation? (Choose two.)

Accepted Answer

dict2items. Dictionaries must be converted to an item list before attribute-based filters can inspect their values. The `dict2items` filter performs that conversion, and `selectattr` then retains only pairs whose value meets the non-empty condition. Together they extract the desired settings, after which the filtered result can be reassembled or merged as needed by downstream tasks.

Answer

rejectattr

Answer

json_query

Answer

combine

Question 13

A playbook reads a list of dictionaries from a variable named 'packages', where each dictionary has keys 'name', 'version', and 'arch'. You need to produce a single list containing only the 'name' values for entries whose 'arch' is 'x86_64'. Which TWO expressions, used together, achieve this? (Choose two.)

Accepted Answer

{{ packages | selectattr('name', 'defined') | selectattr('arch', 'equalto', 'x86_64') | map(attribute='name') | list }}. Producing names for x86_64 entries requires filtering the list by the 'arch' attribute before projecting to 'name'. The correct chains use selectattr with equalto on 'arch', then map with attribute='name', and finish with list to yield a concrete list. The defensive defined check does not change the output.

Answer

{{ packages | map(attribute='name') | selectattr('arch', 'equalto', 'x86_64') | list }}

Answer

{{ packages | rejectattr('arch', 'equalto', 'x86_64') | map(attribute='name') | list }}

Answer

{{ packages | selectattr('arch', 'equalto', 'x86_64') | map(attribute='name') }}

Question 14

A playbook reads a JSON file containing a list of servers, each with a 'tags' dictionary. You need to build a new list containing only the server names whose tags include the key 'env' with value 'prod'. Which expression correctly filters the list using Ansible filters?

Accepted Answer

{{ servers | selectattr('tags.env', 'equalto', 'prod') | map(attribute='name') | list }}. Filtering a list of mappings by a nested key-value pair uses selectattr with a dotted attribute path and an equality test. Keeping the original dictionaries until after filtering preserves the association with each server, and then map extracts the name field. This produces the required list of names for servers tagged with the production environment, using native Ansible filters rather than external query syntax.

Answer

{{ servers | selectattr('tags', 'contains', 'env=prod') | map(attribute='name') | list }}

Answer

Answer

{{ servers | map(attribute='tags.env') | select('equalto', 'prod') | list }}

Question 15

You have a variable `config` that is a list of dictionaries, each representing a network interface with keys `name`, `ip`, and `mtu`. You need to create a new list containing only the `ip` values for interfaces where `mtu` is greater than 1500. Which expression should you use?

Accepted Answer

{{ config | selectattr('mtu', 'gt', 1500) | map(attribute='ip') | list }}. Filtering a list of dictionaries by a numeric attribute requires `selectattr` with the appropriate test, such as `gt` for greater than. After filtering, `map(attribute='ip')` extracts the desired field. The `list` filter ensures the result is a concrete list rather than a generator, which is often necessary for further processing or output.

Answer

{{ config | selectattr('mtu', 'greaterthan', 1500) | map(attribute='ip') | list }}

Answer

{{ config | map(attribute='mtu') | select('gt', 1500) | map(attribute='ip') | list }}

Answer

{{ config | selectattr('mtu', '>', 1500) | map(attribute='ip') | list }}