EX294 Hard Questions — 25 Difficult Questions

Question 1

You are building an execution environment for a large enterprise that requires several collections from both Red Hat Automation Hub and an internal GitLab repository. Your execution-environment.yml file includes both sources. However, the build process consistently fails during the 'adding collections' step with an error indicating that a specific collection from the internal Git repository cannot be found. You have confirmed that the Git repository URL and branch are correct, and that the repository is accessible from the build host. The collection's galaxy.yml file exists and is valid. What is the most likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ansible-builder process does not have the necessary Git credentials configured.. The ansible-builder process requires Git credentials to clone collections from private Git repositories. Even if the URL and branch are correct and the repository is accessible from the build host, the builder itself may not have the necessary SSH keys or HTTPS credentials configured. This is a common oversight when using internal GitLab repositories, as the builder runs in a containerized environment that does not inherit the host's credentials by default.

Answer

The base image does not have Git installed.

Answer

The collection's Galaxy namespace conflicts with a collection from Automation Hub.

Answer

The 'requirements.yml' file for the internal collection is missing.

Question 2

What is the most likely cause of the failure?

Accepted Answer

The credential type is incorrect; it should be a Source Control credential, not Machine.. The credential type must match the service. A Machine credential is used for SSH/WinRM access, not for source control authentication. When using an SCM project to source inventory, the credential should be a Source Control credential (e.g., for Git) to authenticate to the repository. Option A is incorrect because inventory type 'scm' is valid for sourcing from a project; the failure is credential-related, not inventory type. Option B is incorrect because source_path can point to either a file or a directory within the project. Option C is incorrect because source_project can accept either the project name or ID. Option D is incorrect because update_cache_timeout=0 is a valid value that disables caching.

Answer

The inventory must be of type 'file' rather than 'scm'.

Answer

The source_path is incorrect because it should be a directory, not a file.

Answer

The source_project should reference the project ID, not name.

Answer

The update_cache_timeout should be a positive integer.

Question 3

A senior engineer needs to debug an Ansible playbook that uses lookups. Which TWO plugins can be used to retrieve data from a file on the control node? (Select exactly two.)

Accepted Answer

file. The `file` lookup plugin reads the content of a file from the control node's filesystem and returns it as a string. This is the standard way to retrieve file data directly from the Ansible control node without transferring the file to the managed host.

Answer

ini

Answer

password

Answer

csvfile

Question 4

After rotating the Ansible Vault password in the automation controller, several job templates that use vault credentials start failing with 'decryption failed'. The vault credential has been updated with the new password. What is the most likely cause of the failure?

Accepted Answer

The vault file in the project repository still uses the old vault password and needs to be re-encrypted with the new password.. The vault file itself is encrypted with a specific password. When the vault password is rotated in the automation controller, the vault file stored in the project repository is still encrypted with the old password. The job template uses the vault credential to decrypt the file, but since the credential now holds the new password, decryption fails. The vault file must be re-encrypted with the new password using `ansible-vault rekey` or by decrypting and re-encrypting it.

Answer

The automation controller needs a restart to apply the new vault credential.

Answer

The vault credential is not linked to the job template correctly.

Answer

The vault credential type requires the old password to be stored separately.

Question 5

Given the command and error above, what is the most likely cause of the failure?

Accepted Answer

The --vault-id syntax is incorrect; 'vault@prompt' should be a label and password source, not a vault file.. The `--vault-id` option expects a label and a password source (e.g., `vault@prompt` means the label is 'vault' and the password is prompted interactively). The error indicates that Ansible is interpreting the entire string as a vault file path, which fails because no file named 'vault@prompt' exists. Option C correctly identifies that the syntax is being misapplied.

Answer

The vault file 'vault@prompt' does not exist.

Answer

The vault password file must be encrypted with ansible-vault.

Answer

The --check flag is incompatible with vault encryption.

Question 6

An administrator has a requirements.yml file specifying roles from multiple sources: a public Galaxy server, a private Git repository, and a local path. They want to install all roles into the roles directory of the current project. Which command will achieve this?

Accepted Answer

ansible-galaxy install -r requirements.yml --roles-path ./roles. `ansible-galaxy install -r requirements.yml --roles-path ./roles` reads the requirements file and specifies the target directory for role installation. Option A is incorrect because it uses `collection install`, which installs collections, not roles. Option C is incorrect because `-p .` installs roles into the current directory, not the `roles` subdirectory. Option D is incorrect because while it installs roles, the `--force` flag is unnecessary and may overwrite existing roles without need.

Answer

ansible-galaxy collection install -r requirements.yml

Answer

ansible-galaxy install -r requirements.yml -p .

Answer

ansible-galaxy role install --force -r requirements.yml

Question 7

An organization uses Ansible Automation Platform to perform rolling updates on a 5-node PostgreSQL replication cluster. The playbook uses `serial: 1` and includes tasks to promote a standby, demote the primary, update PostgreSQL packages, and then re-elect the original primary. The cluster health check task verifies that replication lag is under 10 seconds before proceeding to the next node. Recently, during an update of the primary node (node1), the health check after re-election fails because replication lag is 15 seconds due to a large write load. The playbook aborts, leaving the cluster in a degraded state with node1 updated but not serving as primary. The administrator needs to ensure that the update continues while still maintaining cluster integrity. Which action should the administrator take?

Accepted Answer

Wrap the update tasks in a block with a rescue handler that reverts the update on the failed host and then continues with the next host.. Using a rescue block allows reverting the update on node1 (e.g., demote it back to standby, re-promote the original standby) so the cluster returns to its original state, and then continue with the next node. This ensures no node remains in an inconsistent state and the update can proceed. Option B is wrong because `ignore_errors` would continue without reverting the failed node, leaving node1 in a half-updated state that could cause issues. Option C is wrong because removing the health check could allow a broken cluster state to go undetected, risking data integrity. Option D is wrong because `max_fail_percentage: 20` would allow only 1 failure out of 5, but if node1 fails, the count is 1 (20%), so the playbook would still abort; even if it continued, it would not revert the failed node, leading to inconsistencies.

Answer

Add `ignore_errors: yes` to the health check task so the playbook continues despite the failure.

Answer

Remove the health check task to allow the update to proceed without interruption.

Answer

Set `max_fail_percentage: 20` to allow up to one failure per update run.

Question 8

Which TWO statements about Ansible role defaults are true?

Accepted Answer

Defaults are loaded from the defaults/main.yml file.. Ansible role defaults are defined in the defaults/main.yml file within the role directory structure. These defaults provide the most basic variable values that can be easily overridden by any other variable source, ensuring flexibility in role usage.

Answer

Defaults are only loaded if no vars are defined.

Answer

Defaults have higher priority than variables defined in the playbook.

Answer

Defaults cannot be overridden.

Question 9

An Ansible playbook uses 'async' and 'poll' to run a long-running task. The task returns a changed status and the playbook continues. However, the remote server reports that the task failed after the playbook finished. What is the most likely reason?

Accepted Answer

The task's return code was not checked; 'async_status' module should be used to explicitly check the job result.. When a task is launched with `async` and `poll: 0`, Ansible does not wait for the task to complete; it immediately continues the playbook. The task runs in the background on the remote host, and its final result (including failure) is not automatically captured by the playbook. To retrieve the actual exit status and output, you must explicitly use the `async_status` module with the job ID to poll the task until it finishes. Without this explicit check, the playbook may report success even if the background task ultimately fails.

Answer

The 'async' timeout was set too high.

Answer

The 'poll' interval was set too low.

Answer

The playbook used 'ignore_errors: true' on the async task.

Question 10

A company wants to implement a rolling update for a stateful application where hosts cannot be updated in parallel due to data consistency. They also need to ensure that if any host fails, the entire update is rolled back. Which strategy meets these requirements?

Accepted Answer

Use serial: 1 and any_errors_fatal: yes. Setting `serial: 1` ensures hosts are updated one at a time, preventing parallel updates that could break data consistency for a stateful application. Adding `any_errors_fatal: yes` causes the entire playbook run to abort immediately if any host fails, which satisfies the requirement for a full rollback on failure.

Answer

Use serial: 2 and any_errors_fatal: yes

Answer

Use serial: 1 and ignore_errors: yes

Answer

Use serial: 0 and max_fail_percentage: 0

Question 11

An Ansible playbook fails intermittently due to a service not starting in time. The administrator wants to configure a task to retry until the service confirms it is running. Which Ansible feature should be used?

Accepted Answer

Until loop with retries and delay.. (Until loop with retries and delay) is correct. The 'until' loop in Ansible allows a task to be retried until a condition is met, with configurable retries and delay. Option B (failed_when) defines when a task is considered failed but does not provide retry functionality. Option C (block/rescue) is used for error handling but does not retry the original task. Option D (async with poll) is for running tasks asynchronously and polling for completion, but it does not inherently retry on failure.

Answer

Failed_when with conditional retry.

Answer

Block and rescue to catch failure.

Answer

Async with poll interval.

Question 12

You are managing a large infrastructure of 500 Linux servers. The servers are divided into groups: 'web', 'app', and 'db'. Each group has specific configuration requirements. You have developed a set of Ansible roles to manage these configurations. Recently, you noticed that when you run the playbook against all servers, the 'web' role is applied to 'app' servers due to a variable misconfiguration. The playbook uses include_role with a variable that determines which role to apply. The variable is defined in group_vars/all.yml as 'server_role: web'. However, each group should have its own role: 'web' for web servers, 'app' for app servers, 'db' for db servers. The playbook includes the role based on '{{ server_role }}'. What is the best course of action to fix this issue without modifying the playbook structure?

Accepted Answer

Define the server_role variable in group_vars/web.yml, group_vars/app.yml, and group_vars/db.yml with the appropriate values.. Ansible's variable precedence dictates that group_vars/<group_name>.yml files override group_vars/all.yml for hosts in that group. By defining `server_role` per group file (web, app, db), each server gets the correct role without modifying the playbook structure. This leverages Ansible's built-in group variable inheritance to resolve the misconfiguration cleanly.

Answer

Change the variable in group_vars/all.yml to a list and use 'include_role' with loop.

Answer

Add a 'when' condition to the include_role task to check the group name.

Answer

Define the server_role in host_vars for each server.

Question 13

Refer to the exhibit. An Ansible playbook targeting server1 fails with a permissions error when connecting. The administrator notices the SSH private key is being used. Which change will likely fix the issue?

Accepted Answer

Change ansible_user to 'ec2-user'.. The error indicates that the SSH private key being used does not correspond to the user attempting to connect. In many cloud environments like AWS, the default user for Amazon Linux 2 is 'ec2-user', and the SSH private key is tied to that user. Changing `ansible_user` to 'ec2-user' ensures the correct user context for key-based authentication, resolving the permissions error.

Answer

Add `ansible_become: yes` to the playbook.

Answer

Remove ansible_ssh_common_args.

Answer

Set ansible_ssh_private_key_file to a different key.

Question 14

In OpenShift, a deployment must gradually shift traffic to new pods during a rolling update. Which default strategy achieves this?

Accepted Answer

RollingUpdate. The RollingUpdate strategy is the default deployment strategy in OpenShift (and Kubernetes) that gradually replaces old pods with new ones while maintaining application availability. It achieves this by incrementally scaling down the old ReplicaSet and scaling up the new one, controlled by parameters like maxSurge and maxUnavailable, ensuring a smooth transition of traffic to new pods.

Answer

Blue-green deployment

Answer

Canary deployment

Answer

Custom strategy

Answer

Recreate

Question 15

Refer to the exhibit. The administrator observes the output and is concerned because the 'Check on async job' task shows 'finished: 0'. What does this indicate?

Accepted Answer

The async job is still running.. In the context of ansible async jobs, 'finished: 0' indicates that the job has not completed yet and is still running. A value of '1' would mean the job finished. Therefore, the administrator's concern that the job shows 'finished: 0' is correct because it means the task is still in progress.

Answer

The async job was not started.

Answer

The async job failed.

Answer

The async job has completed successfully.

Question 16

The build fails with a DNS resolution error for `registry.redhat.io`. Which troubleshooting step is most likely to resolve the issue?

Accepted Answer

Verify DNS settings in `/etc/resolv.conf` or configure a custom DNS server for the container runtime.. A DNS resolution error for `registry.redhat.io` indicates that the container runtime (e.g., Podman) cannot resolve the registry's hostname to an IP address. This is a network/DNS issue, not an authentication or caching problem. Verifying or correcting DNS settings in `/etc/resolv.conf` or configuring a custom DNS server for the container runtime directly addresses the root cause by ensuring the host or container runtime can resolve the registry's FQDN.

Answer

Run `podman login registry.redhat.io` to authenticate.

Answer

Restart the container runtime service.

Answer

Use the `--no-cache` flag to force a fresh build.

Question 17

An admin imports this inventory into AAP and assigns a machine credential that uses SSH key authentication. The job fails with 'Authentication failed'. What is the most likely cause?

Accepted Answer

The machine credential does not contain an SSH private key.. In Red Hat Ansible Automation Platform (AAP), when a machine credential is assigned to a host, that credential's SSH key is used for authentication. If the credential does not contain an SSH private key, authentication will fail. Credentials take precedence over inventory variables such as ansible_ssh_private_key_file, so a conflict is not the likely cause. Therefore, the most likely cause is that the machine credential is missing its SSH private key.

Answer

The private key file path in the inventory does not exist on the controller.

Answer

The credential's SSH key is not being used because the inventory variable ansible_ssh_private_key_file conflicts.

Answer

The 'ansible_become' variable is missing from the inventory.

Question 18

You have two dictionaries: `dict1: {a: 1, b: 2}` and `dict2: {b: 3, c: 4}`. You want a new dict that combines both, with `dict2` values taking precedence for overlapping keys. Which filter chain achieves this?

Accepted Answer

`dict2 | combine(dict1, recursive=True)`. With recursive=True, the combine filter performs a deep merge where the left-hand operand (dict2) retains its values for overlapping keys when combined with dict1. This satisfies the requirement that dict2 values take precedence for the overlapping key 'b', resulting in {a: 1, b: 3, c: 4}.

Answer

`dict2 | combine(dict1)`

Answer

`[dict1, dict2] | combine`

Answer

`dict1 | combine(dict2)`

Question 19

Refer to the exhibit. An administrator runs an Ansible playbook and gets an unreachable error. The administrator has set ansible.cfg as shown. Which configuration change would most likely resolve the issue?

Accepted Answer

Set 'ask_pass = true' in ansible.cfg.

Answer

Set 'become_ask_pass = false' in ansible.cfg.

Answer

Set 'host_key_checking = False' in ansible.cfg.

Answer

Add 'remote_user: root' to the playbook.

Question 20

Refer to the exhibit. A playbook fails with the error 'file not found: /var/www/app-v2.1.0.tar.gz' on the control node. What is the most likely cause?

Accepted Answer

The archive file does not exist on the control node. The copy task uses a relative path to the source file on the control node, which is not found.

Answer

The become: yes is missing from the copy task

Answer

The remote_src parameter is not set in the copy task

Answer

The unarchive task should use remote_src: no