EX294 Hard Questions — 25 Difficult Questions

Question 1

A senior engineer needs to debug an Ansible playbook that uses lookups. Which TWO plugins can be used to retrieve data from a file on the control node? (Select exactly two.)

Accepted Answer

file. The `file` lookup plugin reads the content of a file from the control node's filesystem and returns it as a string. This is the standard way to retrieve file data directly from the Ansible control node without transferring the file to the managed host.

Answer

ini

Answer

password

Answer

csvfile

Question 2

A large enterprise manages thousands of servers grouped by data center. They are designing a rolling update that must complete within a maintenance window. Which combination of Ansible strategies best minimizes total update time while maintaining safety?

Accepted Answer

Set serial to 10% and max_fail_percentage to 25%.. Setting `serial: 10%` updates hosts in batches of 10% of the inventory, which parallelizes the update across many hosts to minimize total time, while `max_fail_percentage: 25%` provides a safety net by aborting the play if more than 25% of the batch fails, preventing a cascade of failures from taking down the entire data center. This combination balances speed and safety for large-scale rolling updates within a maintenance window.

Answer

Set serial: 0 to update all hosts simultaneously.

Answer

Set forks to 100 and max_fail_percentage to 50.

Answer

Set serial to 1 to update one host at a time with max_fail_percentage: 0.

Question 3

An administrator has a requirements.yml file specifying roles from multiple sources: a public Galaxy server, a private Git repository, and a local path. They want to install all roles into the roles directory of the current project. Which command will achieve this?

Accepted Answer

ansible-galaxy install -r requirements.yml --roles-path ./roles. The command 'ansible-galaxy install -r requirements.yml --roles-path ./roles' installs roles from a requirements file into the specified roles directory. The '--roles-path' option (or '-p') sets the destination, and '-r' specifies the requirements file. This meets the requirement to install all roles into the roles directory of the current project.

Answer

ansible-galaxy collection install -r requirements.yml

Answer

ansible-galaxy install -r requirements.yml -p .

Answer

ansible-galaxy role install --force -r requirements.yml

Question 4

An organization uses Ansible Tower (AWX) for rolling updates. They have a job template that runs a playbook with serial: 5. The inventory contains 50 hosts. The update fails after the first batch due to a syntax error in a playbook. After fixing the error, the administrator wants to resume updating from where it left off without updating already successful hosts. Which approach achieves this?

Accepted Answer

Use the job template survey to input a list of hosts to skip, and pass it as --limit.. Ansible Tower's job template survey can collect a list of hosts to skip, which is then passed as the `--limit` option to the playbook. This allows the administrator to resume the rolling update from the next batch by excluding the first five already-successful hosts, avoiding re-running the playbook on them.

Answer

Create a new job template with a dynamic inventory subset excluding the first batch hosts.

Answer

Modify the playbook to check if a host has already been updated using a fact and skip it.

Answer

Rerun the entire playbook; Ansible will skip hosts that are already in the desired state.

Question 5

A DevOps engineer is responsible for coordinating a rolling update of a Red Hat OpenShift Container Platform 4.12 cluster with 10 worker nodes. The cluster hosts a stateful application that uses persistent volumes with ReadWriteOnce access mode. The update involves a minor version upgrade of the cluster from 4.12.0 to 4.12.5. The engineer uses the recommended `oc adm upgrade` command. During the update, after the first worker node is updated, the engineer notices that the node's status shows 'NotReady' and the cluster version operator reports a degraded status. A check of the node logs reveals 'kubelet: Failed to run kubelet: Could not get kubelet config from cluster: could not get config from cluster: context deadline exceeded'. Which action should the engineer take first?

Accepted Answer

Check the network connectivity between the updated node and the control plane nodes on port 6443.. The error indicates the kubelet cannot communicate with the control plane on port 6443, likely due to a network issue (e.g., firewall, DNS, or routing). Option A is wrong because rolling back the entire cluster is a drastic first step; the issue is likely isolated. Option C is wrong because changing kubelet parameters is not a standard resolution for connectivity problems. Option D is wrong because rebuilding the node from scratch is unnecessary and time-consuming; the issue is likely resolvable by restoring network connectivity.

Answer

Rebuild the node from scratch using the machine config operator.

Answer

Roll back the entire cluster to version 4.12.0 using the `oc adm upgrade --to=4.12.0` command.

Answer

Increase the kubelet's `--node-status-update-frequency` parameter on the updated node.

Question 6

You manage an Ansible Tower instance that has multiple inventories synced from different sources (static, dynamic cloud, and satellite). Recently, a job template that uses an inventory synced from Red Hat Satellite fails with 'No hosts matched' even though hosts exist in Satellite. The inventory sync job runs successfully and shows hosts populated in Tower. The job template uses a limit field set to '*' and there are no tags or other filters. The playbook is simple: 'hosts: all'. What is the most likely cause?

Accepted Answer

The inventory source is configured to use 'scraped from project' instead of 'satellite'.. If the inventory source is configured to use 'scraped from project' instead of 'satellite', the inventory will not contain hosts from Satellite. Although the sync runs successfully, it imports hosts from a project file, not from Satellite. Consequently, the job template's playbook with 'hosts: all' will find no hosts from Satellite, resulting in 'No hosts matched'. To resolve, configure the inventory source to 'Red Hat Satellite' with the correct credential and organization.

Answer

The inventory sync job is not scheduled to run before the job template.

Answer

The groups imported from Satellite are nested and the job template's limit does not include the parent group.

Answer

The credential used for Satellite sync is expired.

Question 7

A company manages a large infrastructure of 10,000 servers using Ansible. The Ansible control node runs on a powerful machine with 32 cores and 64GB RAM. Recently, a playbook that processes server facts and generates a compliance report has become extremely slow, taking over 6 hours to complete. The playbook uses several `set_fact` tasks with complex jinja2 filters including `selectattr`, `map`, `json_query`, and `combine`. The inventory is stored in a dynamic inventory script that returns JSON. The team suspects that the filter operations are causing performance bottlenecks, especially when creating large data structures. A junior engineer suggests splitting the playbook into multiple plays and using `delegate_to` to distribute processing across managed nodes. Another suggests using the `ansible.builtin` module instead of filters. The senior architect recommends converting the heavy filter logic into a custom action plugin. What is the most effective approach to significantly reduce the execution time while maintaining functionality?

Accepted Answer

Convert the heavy filter logic into a custom Python action plugin that runs on the control node and performs data transformation efficiently.. Custom action plugins execute Python code directly on the control node, bypassing the Jinja2 templating engine entirely. This eliminates the overhead of parsing complex filters like `json_query` and `combine` for every host, which is the primary bottleneck when processing large data structures across 10,000 servers. Action plugins also have full access to Ansible's internal APIs, allowing efficient in-memory data transformations without the serialization/deserialization costs of `set_fact`.

Answer

Distribute the processing across managed nodes using `delegate_to` and loop over hosts.

Answer

Use `ansible.builtin` modules to replace filter operations; for example, use `add_host` and `group_by` to structure data.

Answer

Use `with_items` and `with_nested` loops instead of filters, as loops are faster.

Question 8

An Ansible playbook uses a rolling update strategy with serial: 1. After the first host is updated, the playbook stops and shows 'PLAY RECAP' with only one host. What is the most likely reason?

Accepted Answer

the inventory contains only one host. The `serial: 1` directive in Ansible limits concurrency to one host at a time, but the playbook will still process all hosts in the inventory. If the playbook stops after the first host and shows PLAY RECAP with only one host, the most likely reason is that the inventory contains only one host. With a single host, the play executes on that host and then finishes. Option B accurately identifies this scenario.

Answer

the playbook has a 'failed_when' condition that stops execution

Answer

the play uses 'delegate_to' incorrectly

Answer

the playbook does not have any task that triggers the next batch, and 'serial' only controls concurrency, not retry

Question 9

An Ansible automation is used to manage firewall rules on a set of Linux servers. The playbook defines a variable "allow_rules" as:
allow_rules:
  - proto: tcp
    dport: 80
    comment: HTTP
  - proto: tcp
    dport: 443
    comment: HTTPS

The engineer needs to use the "iptables" module to create rules. The module expects "chain" to be specified, and the engineer wants to dynamically set the chain based on the port: ports 80 and 443 go to "INPUT" chain, while others go to "FORWARD". The engineer writes a loop:
- name: Add iptables rules
  iptables:
    chain: "{{ item.dport | map('some_filter') }}"
    protocol: "{{ item.proto }}"
    destination_port: "{{ item.dport }}"
    comment: "{{ item.comment }}"
  loop: "{{ allow_rules }}"

But this fails because the chain field expects a string, not a list. The engineer realizes the map filter returns a list. Which of the following modifications correctly sets the chain based on port number?

Accepted Answer

chain: "{{ (item.dport in [80,443]) | ternary('INPUT', 'FORWARD') }}". It uses the `ternary` filter to evaluate a condition (`item.dport in [80,443]`) and return 'INPUT' if true, or 'FORWARD' if false. This produces a single string, which is exactly what the `chain` parameter expects, avoiding the list output from `map`.

Answer

chain: "{{ item.dport | regex_replace('^(80|443)$', 'INPUT') | default('FORWARD', true) }}"

Answer

chain: "{{ item.dport | select('in', [80,443]) | list | first | default('FORWARD') }}"

Answer

chain: "{{ item.dport | replace('80','INPUT') | replace('443','INPUT') | default('FORWARD') }}"

Question 10

Refer to the exhibit. An administrator runs an Ansible playbook and gets an unreachable error. The administrator has set ansible.cfg as shown. Which configuration change would most likely resolve the issue?

Accepted Answer

Set 'ask_pass = true' in ansible.cfg.

Answer

Set 'become_ask_pass = false' in ansible.cfg.

Answer

Set 'host_key_checking = False' in ansible.cfg.

Answer

Add 'remote_user: root' to the playbook.

Question 11

Refer to the exhibit. A playbook fails with the error 'file not found: /var/www/app-v2.1.0.tar.gz' on the control node. What is the most likely cause?

Accepted Answer

The archive file does not exist on the control node. The copy task uses a relative path to the source file on the control node, which is not found.

Answer

The become: yes is missing from the copy task

Answer

The remote_src parameter is not set in the copy task

Answer

The unarchive task should use remote_src: no

Question 12

A managed node is not responding to Ansible automation. The administrator verifies that the node is reachable via SSH and that the SSH key is correctly deployed. However, 'ansible all -m ping' fails with 'UNREACHABLE'. The automation controller uses a custom execution environment. What is the most likely cause?

Accepted Answer

The SSH private key has incorrect permissions on the controller.. The SSH private key must have permissions set to 600 (owner read/write only) for SSH to accept it. Even though the key is correctly deployed on the controller host, the custom execution environment (container) may have different file permissions, or the key might be copied with incorrect permissions. SSH will refuse to use a key with overly permissive settings, resulting in an 'UNREACHABLE' status despite the host being network-reachable.

Answer

The remote user specified in the credential does not have sudo access.

Answer

The custom execution environment is missing the 'python3' or 'python' package.

Answer

The automation controller is behind a firewall that blocks SSH.

Question 13

Refer to the exhibit. An administrator runs a playbook in check mode and receives the shown output. What should be done to fix the failure while maintaining idempotency?

Accepted Answer

Add a task in the apache role to create the /var/www/html directory using the file module.. The failure in check mode indicates that the /var/www/html directory does not exist, and the apache role's copy task cannot write to it. The correct fix is to add a task in the apache role that uses the file module to create the directory with the desired state (e.g., state: directory), ensuring idempotency because the task will only create it if absent. This keeps the role self-contained and maintains idempotent behavior.

Answer

Modify the deploy role to use the force parameter when copying files.

Answer

Run the playbook without check mode to force the deployment.

Answer

Add a pre_task in the playbook to create /var/www/html before roles execute.

Question 14

An operations team is designing a rolling update for a stateful application that requires quorum (minimum 3 out of 5 nodes online). They plan to use Ansible's serial keyword. Which serial value ensures the update proceeds without breaking quorum while still being efficient?

Accepted Answer

serial: 2. Setting serial: 2 ensures that only 2 nodes are taken down at a time during the rolling update. With a quorum requirement of 3 out of 5 nodes, taking down 2 nodes leaves 3 online, maintaining quorum. This is the most efficient value that does not risk breaking quorum.

Answer

serial: 1

Answer

serial: 3

Answer

serial: 5

Question 15

You are managing a large infrastructure of 500 Linux servers. The servers are divided into groups: 'web', 'app', and 'db'. Each group has specific configuration requirements. You have developed a set of Ansible roles to manage these configurations. Recently, you noticed that when you run the playbook against all servers, the 'web' role is applied to 'app' servers due to a variable misconfiguration. The playbook uses include_role with a variable that determines which role to apply. The variable is defined in group_vars/all.yml as 'server_role: web'. However, each group should have its own role: 'web' for web servers, 'app' for app servers, 'db' for db servers. The playbook includes the role based on '{{ server_role }}'. What is the best course of action to fix this issue without modifying the playbook structure?

Accepted Answer

Define the server_role variable in group_vars/web.yml, group_vars/app.yml, and group_vars/db.yml with the appropriate values.. Ansible's variable precedence dictates that group_vars/<group_name>.yml files override group_vars/all.yml for hosts in that group. By defining `server_role` per group file (web, app, db), each server gets the correct role without modifying the playbook structure. This leverages Ansible's built-in group variable inheritance to resolve the misconfiguration cleanly.

Answer

Change the variable in group_vars/all.yml to a list and use 'include_role' with loop.

Answer

Add a 'when' condition to the include_role task to check the group name.

Answer

Define the server_role in host_vars for each server.

Question 16

A developer wrote a custom filter plugin in a Python file `my_filters.py` and placed it in the directory `./filter_plugins/`. The playbook fails with 'ERROR! no filter named 'my_custom_filter''. The playbook is located in `/home/user/project/playbook.yml`. The `ansible.cfg` file in the same directory does not set `filter_plugins`. Which is the most likely cause?

Accepted Answer

The plugin file must be a Python module with a class named `FilterModule` and the filter function must be listed in the `filters` method. Ansible requires custom filter plugins to be Python modules that define a class named `FilterModule` with a `filters()` method returning a dictionary mapping filter names to their implementing functions. Without this structure, Ansible cannot discover or register the filter, causing the 'no filter named' error.

Answer

The filter file must be named `__init__.py`

Answer

The filter function must be imported in the playbook via `filter_plugins: my_filters`

Answer

The filter function name does not match the class name in the plugin

Question 17

The job template running against host db1 uses a machine credential with an SSH key. The key is correctly configured in Automation Controller. However, the job fails with the error shown. What is the most likely cause?

Accepted Answer

The SSH public key corresponding to the private key is not installed on the target host. The error indicates that Automation Controller cannot authenticate to host db1 using the SSH key. Since the key is correctly configured in the controller, the most likely cause is that the corresponding public key is not present in the target host's ~/.ssh/authorized_keys file. SSH key-based authentication requires the private key on the client (controller) and the public key installed on the target host; without the public key, the server rejects the connection attempt.

Answer

The vault password is incorrect

Answer

The SSH port is blocked by a firewall

Answer

The host's SSH host key has changed and the known_hosts file is outdated

Question 18

Refer to the exhibit. An administrator runs an Ansible playbook and receives the error shown. The playbook uses a variable 'vault_httpd_port' that should be stored in an encrypted vault file. Which step should the administrator take first to resolve the issue?

Accepted Answer

Ensure the vault file is referenced in the playbook using include_vars or vars_files, and that the vault password is correct.. The error indicates Ansible cannot find the variable 'vault_httpd_port' because the encrypted vault file containing it is not being loaded into the playbook's variable scope. The administrator must first verify that the vault file is properly referenced via include_vars or vars_files in the playbook, and that the correct vault password is supplied (e.g., via --ask-vault-pass or a vault password file). Without loading the vault file, the variable remains undefined regardless of encryption password changes.

Answer

Re-encrypt the vault file with a different password.

Answer

Add 'vault_httpd_port' to the group_vars/all.yml file without encryption.

Answer

Use the --ask-vault-pass option again with a different password.

Question 19

The debug output shows 'changed' even when the firewall rule already existed. Which filter issue could cause this?

Accepted Answer

The task should use 'immediate: yes' to reload the firewall, otherwise the module always reports changed.. C is correct because the `firewalld` module in Ansible, by default, operates in 'offline' mode (immediate: no), meaning it only modifies the permanent configuration without applying changes to the running runtime firewall. Even if a rule already exists in the permanent configuration, the module will report 'changed' because it still attempts to add the rule to the runtime zone unless `immediate: yes` is explicitly set to reload the firewall and synchronize the runtime state. This behavior is specific to how `firewalld` separates permanent and runtime rule sets.

Answer

The 'changed' key is misspelled as 'change' in the filter.

Answer

The variable 'fw_result' is undefined because the task failed.

Answer

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Question 20

An organization uses a private Git repository to store Ansible content collections. They want to automate the building of execution environments that include these collections. Which approach is recommended?

Accepted Answer

Build the collection manually, publish it to a private Automation Hub, then reference it in the EE.. The recommended workflow for including private collections in an execution environment is to build the collection, publish it to a private Automation Hub, and then reference it in the `execution-environment.yml` file. This ensures the collection is available as a signed, versioned artifact that `ansible-builder` can pull during the build process, maintaining integrity and reproducibility without exposing Git credentials or requiring network access during build.

Answer

Store the collection tarball in a Git LFS and use an ADD command in the base image.

Answer

Add the Git repository as a source in the execution-environment.yml using the 'git' type.

Answer

Use ansible-builder to clone the repository during build with a pre-build script.