EX294 Transform data with filters and plugins — Timed 20 Questions

Question 1

Which TWO filters are used to transform data types in Ansible?

Accepted Answer

bool. In Ansible, the `bool` and `int` filters are specifically designed to convert input values into boolean and integer data types, respectively. These are part of Ansible's Jinja2 filter set for explicit type coercion, enabling tasks to handle variables with the correct data type for conditional logic or arithmetic operations.

Answer

list

Answer

float

Answer

string

Question 2

A DevOps engineer needs to extract the first 10 lines of a log file and store them in a variable for further processing. Which Ansible filter should be used?

Accepted Answer

slice. The `slice` filter in Ansible can be used to extract a portion of a list or string. When applied to a list of lines (obtained by splitting the file content), `slice(0,10)` returns the first 10 lines. While `head` also works on lists, it is not valid for strings when line extraction is needed, as it returns characters. The `slice` filter provides the necessary flexibility to specify a range, making it the most appropriate choice for this scenario.

Answer

regex

Answer

first

Answer

head

Question 3

An Ansible playbook needs to extract the first line from a multi-line string variable 'output' and store it in a new variable 'first_line'. Which filter should be used?

Accepted Answer

{{ output | split('
') | first }}. The `split('
')` filter splits the multi-line string into a list of lines, and the `first` filter extracts the first element. This is the standard Ansible approach to isolate the first line from a string variable.

Answer

Answer

Answer

Question 4

A playbook uses the 'uri' module to query an API and registers the result. The API returns a JSON with a nested field 'data.users[0].name'. Which expression correctly extracts that name?

Accepted Answer

{{ result | json_query("data.users[0].name") }}. Options B and D are both correct because the `json_query` filter accepts JMESPath queries quoted with either single or double quotes. Both `'data.users[0].name'` and `"data.users[0].name"` are syntactically valid in Ansible Jinja2 expressions. The `uri` module parses JSON response into a dictionary, so `result` is the top-level object, and the JMESPath query correctly extracts the nested field. Option C is incorrect because it uses native Jinja2 dot notation, which would only work if `result` were already a deeply nested dictionary, but the registered object may still contain headers and other HTTP metadata. Option A is incorrect because JMESPath uses zero-based index without the dot notation, i.e., `users[0]`, not `users.0`.

Answer

Answer

Question 5

A team is migrating from static inventory to dynamic inventory using a custom script. The script returns JSON with a group 'webservers' containing hosts. However, the playbook targeting 'webservers' fails with 'no hosts matched'. Which filter or plugin issue is most likely?

Accepted Answer

The script output is missing the '_meta' key with 'hostvars'.. Dynamic inventory scripts must include a `_meta` key with `hostvars` in their JSON output for Ansible to properly resolve host variables and match hosts to groups. Without `_meta`, Ansible cannot associate host-specific variables (like `ansible_host`) with the hosts listed under `webservers`, causing the playbook to see no matched hosts even though the group exists.

Answer

The playbook uses 'hosts: all' but should use 'hosts: webservers'.

Answer

The script is not executable.

Answer

The 'ansible_host' variable is not set in hostvars.

Question 6

A playbook needs to set a fact 'total_memory' by summing the 'memory_mb' values from a list of servers. Which filter should be used?

Accepted Answer

{{ servers | map(attribute='memory_mb') | sum }}. It uses the `map` filter with the `attribute` parameter to extract the `memory_mb` value from each dictionary in the list, then pipes the resulting list of integers into the `sum` filter to compute the total. This is the standard Ansible idiom for summing a specific attribute across a list of dictionaries.

Answer

Answer

Answer

Question 7

A playbook uses the 'debug' module to print a variable 'myvar' which is a list of dictionaries. The output shows 'VARIABLE IS UNDEFINED' despite the variable being defined earlier. Which filter issue is most likely?

Accepted Answer

The variable is defined in a role but the playbook uses include_role incorrectly.. When a variable is defined inside a role but the playbook uses `include_role` incorrectly (e.g., without `tasks_from` or with a static import instead of dynamic include), the variable may not be available in the play's variable scope. The `debug` module then reports 'VARIABLE IS UNDEFINED' because the variable was never loaded into the play's namespace. This is a common scoping issue with role variables and dynamic includes.

Answer

The debug task uses 'var: myvar' instead of 'msg: "{{ myvar }}"'.

Answer

The playbook uses 'set_fact' with quotes around the variable name.

Answer

The variable contains a fact that is only available on the control node.

Question 8

Which THREE plugins are used for data transformation in Ansible?

Accepted Answer

lookup. Lookup plugins (B) are used to access external data sources (e.g., files, databases, environment variables) and bring that data into Ansible for transformation or use in tasks. Filter plugins (C) are specifically designed to manipulate and transform data within a playbook, such as converting strings, formatting JSON, or performing mathematical operations. Cache plugins (E) store and retrieve cached data (e.g., facts) to improve performance, which involves data transformation for serialization/deserialization.

Answer

connection

Answer

callback

Question 9

The playbook uses the community.general.parse_csv filter. Assuming the collection is installed, what is the type and structure of the 'parsed' variable?

Accepted Answer

A list of dictionaries: [{'name': 'Alice', 'age': '30'}, {'name': 'Bob', 'age': '25'}]. The `community.general.parse_csv` filter in Ansible parses CSV content into a list of dictionaries, where the first row is treated as headers and subsequent rows become dictionaries with those headers as keys. Option A correctly describes this output: a list of dictionaries with keys 'name' and 'age' and corresponding string values.

Answer

A single string: 'Alice,30
Bob,25'

Answer

A list of strings: ['name,age', 'Alice,30', 'Bob,25']

Answer

A dictionary: {'Alice': '30', 'Bob': '25'}

Question 10

The debug output shows 'changed' even when the firewall rule already existed. Which filter issue could cause this?

Accepted Answer

The task should use 'immediate: yes' to reload the firewall, otherwise the module always reports changed.. C is correct because the `firewalld` module in Ansible, by default, operates in 'offline' mode (immediate: no), meaning it only modifies the permanent configuration without applying changes to the running runtime firewall. Even if a rule already exists in the permanent configuration, the module will report 'changed' because it still attempts to add the rule to the runtime zone unless `immediate: yes` is explicitly set to reload the firewall and synchronize the runtime state. This behavior is specific to how `firewalld` separates permanent and runtime rule sets.

Answer

The 'changed' key is misspelled as 'change' in the filter.

Answer

The variable 'fw_result' is undefined because the task failed.

Answer

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Question 11

Your organization manages a fleet of 500 web servers running RHEL 8. Each server has a custom fact file /etc/ansible/facts.d/web.fact containing:
[web]
docroot=/var/www/html
port=80
admin=admin@example.com

You have a playbook that needs to configure the firewall to allow traffic on the port defined in the custom fact for each server. The playbook uses the 'ansible_local' variable to access these facts. However, some servers have the custom fact file missing or malformed. The task to open the firewall port fails on those servers with 'VARIABLE IS UNDEFINED'. You need to implement a solution that handles missing custom facts gracefully, setting a default port of 8080 if the fact is not defined, and still log a warning. Which approach should you take?

Accepted Answer

Use a 'set_fact' task with 'port: "{{ ansible_local.web.port | default(8080) }}"' and add a 'debug' task with 'when: ansible_local.web.port is undefined' to warn.. It uses the `default` filter to gracefully handle undefined variables, setting a fallback port of 8080 when the custom fact is missing or malformed. The additional `debug` task with `when: ansible_local.web.port is undefined` provides a warning without causing the playbook to fail. This approach aligns with the EX294 objective of transforming data with filters and plugins, specifically using Jinja2 filters to manage missing data.

Answer

Use 'ignore_errors: yes' on the firewall task and then check the result with 'failed_when' to set a default.

Answer

Use 'block' and 'rescue' to catch the error and then set the fact.

Answer

Create a separate playbook for servers without the fact file, running a different role.

Question 12

An Ansible playbook needs to generate a list of IP addresses from a range 192.168.1.10 to 192.168.1.20. Which filter should be used in a Jinja2 template?

Accepted Answer

{{ '192.168.1.10-20' | ipaddr('range_include') }}. The `ipaddr` filter with the `'range_include'` parameter generates a list of all IP addresses within a specified range, including both endpoints. In this case, `'192.168.1.10-20' | ipaddr('range_include')` produces a list from 192.168.1.10 through 192.168.1.20, which is exactly what the playbook needs to generate.

Answer

Answer

Answer

Question 13

A playbook uses the 'debug' module to print a variable 'my_var' but the output is 'VARIABLE IS UNDEFINED'. The variable is defined in group_vars/all.yml. Which filter could be used to provide a default value and avoid this error?

Accepted Answer

{{ my_var | default('fallback') }}. The `default` filter in Ansible provides a fallback value when a variable is undefined, preventing the 'VARIABLE IS UNDEFINED' error. Using `{{ my_var | default('fallback') }}` ensures that if `my_var` is not defined in group_vars/all.yml or any other precedence level, the string 'fallback' is used instead of causing a failure.

Answer

Answer

Answer

Question 14

An Ansible playbook retrieves a list of dictionaries from an API. Each dictionary has keys 'name', 'status', and 'zone'. The playbook needs to filter out entries where 'status' is 'inactive' and then extract only the 'name' values. Which THREE of the following combinations of filters and loops would achieve this?

Accepted Answer

{{ data | rejectattr('status', 'equalto', 'inactive') | map(attribute='name') | list }}. `rejectattr` filters out items where `status` equals 'inactive', and then `map(attribute='name')` extracts the `name` values from the remaining dictionaries. The `| list` filter converts the result into a list. This is a standard Jinja2 filter chain in Ansible for filtering and transforming data.

Answer

{{ data | rejectattr('status', 'equalto', 'inactive') | extract('name') | list }}

Answer

{{ data | selectattr('status != inactive') | map(attribute='name') | list }}

Question 15

You are maintaining an Ansible automation for a large Red Hat Enterprise Linux deployment. The playbook configures NTP servers on all managed nodes. It uses a variable 'ntp_servers' defined in group_vars/all.yml as a list: ['0.rhel.pool.ntp.org', '1.rhel.pool.ntp.org', '2.rhel.pool.ntp.org']. The playbook task uses the 'uri' module to test connectivity to each server, but only if the server is reachable. The task currently uses:

```
- name: Test NTP server reachability
  uri:
    url: "http://{{ item }}:123"
    timeout: 5
  register: result
  loop: "{{ ntp_servers }}"
  until: result.status == 200
  retries: 3
  delay: 2
```

However, the playbook fails because the NTP servers do not respond to HTTP on port 123. You need to change the approach to test ICMP reachability using the 'ping' module, but the 'ping' module does not support a custom destination port. You also want to continue using a loop and register the success/failure per server. Which of the following is the best course of action?

Accepted Answer

Replace the task with the 'command' module to run 'ping -c 1 {{ item }}' and register results, using 'ignore_errors' to handle unreachable servers.. The 'ping' module in Ansible does not support custom ports or protocols, and NTP servers do not respond to HTTP on port 123. Using the 'command' module to run 'ping -c 1' allows ICMP reachability testing, and 'ignore_errors' prevents playbook failure when a server is unreachable, while still registering per-server success/failure via the loop.

Answer

Use the 'slurp' module to read the /etc/hosts file and check if the server is listed.

Answer

Use the 'wait_for' module with 'host={{ item }}' and 'port=123' to test connectivity, since NTP uses UDP 123.

Answer

Use the 'ping' module with a loop over the ntp_servers list, setting the 'data' parameter to the server IP.

Question 16

When using the 'uri' module to interact with a REST API in Ansible, which TWO of the following statements about error handling and response parsing are correct?

Accepted Answer

To access the response body, use the 'body' key of the registered variable and then parse it with a filter like 'json_query'.. When you register the result of an `uri` module call, the response body is stored under the `body` key of the registered variable. To extract or filter data from that JSON body, you can use the `json_query` filter (which relies on jmespath) to parse and query the JSON structure. This is the standard approach for accessing and manipulating API response data in Ansible.

Answer

The 'follow_redirects' parameter must be set to 'all' to handle HTTP 4xx and 5xx errors gracefully.

Answer

The 'failed_when' condition can inspect the HTTP response before the request is sent.

Answer

The 'register' keyword automatically parses JSON responses into Ansible variables.

Question 17

Refer to the exhibit. After running the playbook, the 'content' field contains an HTML page. The team wants to extract the text inside the

tags using Ansible filters. Which of the following tasks correctly extracts the content of the

element?

Accepted Answer

set_fact: heading="{{ result.content | regex_replace('.*

(.*)

.*', '\1') }}". It uses `regex_replace` with a pattern that matches the entire string (`.*

(.*)

.*`) and replaces it with the captured group `\1`, effectively extracting only the heading text. Option B, while it uses `regex_replace`, only matches the `

...

` portion; if the page contains any content outside the `

` tags, that content remains, so it does not reliably extract just the heading text. Options C and D return the full match including the tags, not just the inner text.

Answer

set_fact: heading="{{ result.content | regex_replace('

(.*)

', '\1') }}"

Answer

set_fact: heading="{{ result.content | regex_search('

(.*)

') }}"

Answer

set_fact: heading="{{ result.content | regex_findall('

(.*)

') | first }}"

Question 18

You are managing a fleet of 200 RHEL 8 servers with Ansible Tower. A playbook uses the 'seboolean' module to enable httpd_can_network_connect for a web application. Recently, the playbook has been failing on 10 servers with the error: 'Failed to set SELinux boolean: Unable to communicate with SELinux policy'. Other servers succeed. The playbook runs as the 'ansible' user with passwordless sudo. The failing servers have identical SELinux configuration (enforcing mode, targeted policy) and the same package versions as working servers. You suspect the issue is related to the 'python3-libselinux' package. Which of the following is the most likely cause and the correct fix?

Accepted Answer

The 'python3-libselinux' package is missing on the failing servers. Install it with 'dnf install python3-libselinux'.. The error 'Failed to set SELinux boolean: Unable to communicate with SELinux policy' indicates that the Python bindings required to interact with the SELinux policy are missing. The 'seboolean' module in Ansible relies on the 'python3-libselinux' package to communicate with the SELinux subsystem. Since the playbook runs as the 'ansible' user with passwordless sudo, and the failing servers have identical SELinux configuration and package versions except for this missing dependency, installing 'python3-libselinux' resolves the issue.

Answer

The 'python2-libselinux' package is required because Ansible uses Python 2. Install it with 'dnf install python2-libselinux'.

Answer

The 'ansible' user lacks sudo access to the 'seboolean' command. Add a sudoers entry to allow it.

Answer

The 'libsemanage' package is missing. Install it with 'dnf install libsemanage'.

Question 19

Drag and drop the steps to set up a cron job that runs a script every day at 2 AM in the correct order.

Accepted Answer

Prepare script, test script, edit crontab, add entry with correct syntax, verify. Cron setup: prepare script, test, edit crontab, add entry with correct syntax, verify.

Answer

Edit crontab, add entry, prepare script, test, verify

Answer

Prepare script, edit crontab, add entry, test, verify

Answer

Test script, prepare script, edit crontab, add entry, verify

Question 20

Match each SELinux context component to its meaning.

Accepted Answer

user: The SELinux user identity that defines which roles a user can enter.. The SELinux security context consists of user:role:type:level. User identifies the SELinux user, role defines allowed types via RBAC, type is for Type Enforcement, and level for MLS/MCS. Common confusions include mistaking user for process attributes or role for hardware.

Answer

user: The component that specifies the process's current working directory.

Answer

role: The component that defines the hardware architecture.