EX294 Timed Hard Questions — 25 Difficult Questions

Question 1

An organization uses a proprietary API service that requires token-based authentication with a base64-encoded payload including username, password, and tenant ID. The administrator wants to create a custom credential type in automation controller so that users can input these three values separately, and the playbook receives the final token. Which input configuration fields should be defined?

Accepted Answer

Three separate text fields (username, password, tenant ID) with a custom injector template that concatenates and base64-encodes them.. Custom credential types allow multiple inputs and an injector template to transform them. Option B allows users to input each component separately and the injector creates the base64 token. Option A only stores the token. Option C misses tenant ID. Option D is not user-friendly.

Answer

One text field for the token, and inject it as an environment variable.

Answer

Two fields: username and password, and use a lookup plugin to fetch tenant ID.

Answer

Create a single multiline text field where users paste the base64 string.

Question 2

A Red Hat Ansible Automation Platform deployment uses automation mesh to manage remote nodes across a high-latency WAN. An administrator notices that some job runs fail intermittently due to connection timeouts. The administrator wants to improve reliability without changing network infrastructure. Which configuration change is most effective?

Accepted Answer

Increase the 'timeout' value in the [defaults] section of ansible.cfg to 60 seconds.. Option A is correct because increasing the 'timeout' value in the [defaults] section of ansible.cfg extends the SSH connection timeout, which directly addresses intermittent failures caused by high-latency WAN links. This change allows Ansible to wait longer for a remote node to respond before aborting the connection, improving reliability without altering network infrastructure.

Answer

Increase the 'retries' parameter for each task.

Answer

Increase the 'forks' value in ansible.cfg to 50.

Answer

Set 'async: 600' and 'poll: 10' in the playbook.

Question 3

A managed node is not responding to Ansible automation. The administrator verifies that the node is reachable via SSH and that the SSH key is correctly deployed. However, 'ansible all -m ping' fails with 'UNREACHABLE'. The automation controller uses a custom execution environment. What is the most likely cause?

Accepted Answer

The custom execution environment is missing the 'python3' or 'python' package.. Option C is correct because the custom execution environment is a container image that must contain the Python interpreter (python3 or python) for Ansible to execute modules on the managed node. When the environment lacks Python, the 'ansible -m ping' module cannot be transferred and executed, resulting in an 'UNREACHABLE' status despite SSH connectivity being verified.

Answer

The SSH private key has incorrect permissions on the controller.

Answer

The remote user specified in the credential does not have sudo access.

Answer

The automation controller is behind a firewall that blocks SSH.

Question 4

Which TWO of the following are best practices when coordinating rolling updates with Ansible?

Accepted Answer

Define a 'max_fail_percentage' to abort the update if too many hosts fail.. Option A is correct because 'max_fail_percentage' allows you to define a threshold of host failures (as a percentage of the batch size) that, when exceeded, causes Ansible to abort the entire rolling update. This prevents the update from continuing when too many hosts have failed, which could lead to an inconsistent or degraded state across the infrastructure. Option B is correct because the 'serial' keyword controls the number of hosts (or percentage) that Ansible updates in each batch, ensuring that only a subset of hosts is taken out of service at a time, which maintains overall service availability during the rolling update.

Answer

Use 'strategy: free' to allow hosts to run tasks independently.

Answer

Use 'gather_facts: no' to speed up the playbook.

Answer

Set 'any_errors_fatal: true' to stop the update on the first failure.

Question 5

Refer to the exhibit. A developer builds an execution environment using this execution-environment.yml. After building, the container starts but ansible-navigator cannot connect to the container because the required SSH packages are missing. Which file most likely needs to be updated?

Accepted Answer

bindep.txt. D is correct because `bindep.txt` specifies system-level package dependencies (like `openssh-clients` or `sshpass`) that must be installed in the container image. When building an execution environment, `ansible-builder` reads `bindep.txt` to install RPM packages via `dnf` (or `apt` on Debian-based images). If SSH packages are missing, the `bindep.txt` file is the most likely place to add them, as it directly controls which system packages are included in the final image.

Answer

The base image itself

Answer

requirements.yml

Answer

requirements.txt

Question 6

Which THREE of the following are valid directives that can be used in an `execution-environment.yml` file for `ansible-builder`?

Accepted Answer

`version:`. Option B is correct because `version:` is a valid directive in an `execution-environment.yml` file for ansible-builder. It specifies the version of the execution environment definition format, ensuring compatibility with the builder tool. This directive is used at the top level of the file to declare the schema version, such as `version: 1`.

Answer

`system_packages:`

Answer

`python_requirements:`

Question 7

An execution environment is built using ansible-builder. The definition file includes a base image from registry.redhat.io. After building, the container runs but ansible-navigator can't find the EE. What is the most likely cause?

Accepted Answer

The EE was not pushed to a registry accessible by ansible-navigator.. The most likely cause is that the execution environment (EE) was built locally but not pushed to a registry that `ansible-navigator` can access. By default, `ansible-navigator` pulls EEs from a container registry (e.g., `registry.redhat.io` or a private registry) specified in its configuration; it does not automatically discover locally built images. If the EE is only present in the local Docker/Podman store, `ansible-navigator` will fail to find it, resulting in a runtime error.

Answer

ansible-navigator uses a different Python interpreter.

Answer

The base image is not compatible with the installed collections.

Answer

The EE was not tagged correctly.

Question 8

You are building an execution environment for a large enterprise that requires several collections from both Red Hat Automation Hub and an internal GitLab repository. Your execution-environment.yml file includes both sources. However, the build process consistently fails during the 'adding collections' step with an error indicating that a specific collection from the internal Git repository cannot be found. You have confirmed that the Git repository URL and branch are correct, and that the repository is accessible from the build host. The collection's galaxy.yml file exists and is valid. What is the most likely reason for the failure?

Accepted Answer

The ansible-builder process does not have the necessary Git credentials configured.. The correct answer is D. The ansible-builder process requires Git credentials to clone collections from private Git repositories. Even if the URL and branch are correct and the repository is accessible from the build host, the builder itself may not have the necessary SSH keys or HTTPS credentials configured. This is a common oversight when using internal GitLab repositories, as the builder runs in a containerized environment that does not inherit the host's credentials by default.

Answer

The base image does not have Git installed.

Answer

The collection's Galaxy namespace conflicts with a collection from Automation Hub.

Answer

The 'requirements.yml' file for the internal collection is missing.

Question 9

An admin imports this inventory into AAP and assigns a machine credential that uses SSH key authentication. The job fails with 'Authentication failed'. What is the most likely cause?

Accepted Answer

The credential's SSH key is not being used because the inventory variable ansible_ssh_private_key_file conflicts.. Option B is correct because AAP does not use inventory variables for authentication; it uses credentials. The variable 'ansible_ssh_private_key_file' is ignored by AAP, and the credential must be used. Option A is incorrect because the credential is present. Option C is incorrect because the key path is not used. Option D is incorrect because the become method is not relevant to this failure.

Answer

The private key file path in the inventory does not exist on the controller.

Answer

The machine credential does not contain an SSH private key.

Answer

The 'ansible_become' variable is missing from the inventory.

Question 10

After upgrading AAP, an admin notices that all job templates using a custom virtual environment fail with 'No module named 'foo''. The virtual environment was previously working. What should the admin do first?

Accepted Answer

Recreate the custom virtual environment and reinstall the 'foo' package.. After an AAP upgrade, custom virtual environments are not automatically migrated or preserved; they must be recreated and their packages reinstalled. The 'No module named 'foo'' error indicates that the Python environment no longer contains the required package, so recreating the environment and reinstalling 'foo' is the correct first step to restore functionality.

Answer

Switch the job template to use an execution environment instead.

Answer

Reassign the job template to the default virtual environment.

Answer

Verify that the credential associated with the job template is valid.

Question 11

Which THREE of the following are valid Ansible lookup plugins? (Select exactly three.)

Accepted Answer

`csvfile`. Option A is correct because `csvfile` is a built-in Ansible lookup plugin that reads data from CSV files, allowing playbooks to parse structured tabular data. It is documented in the official Ansible lookup plugin list and is commonly used for dynamic inventory or configuration values.

Answer

`map`

Answer

`select`

Question 12

A company uses Ansible Tower and has defined a custom inventory script. The inventory returns JSON with nested groups. The playbook needs to list all hosts from a specific group 'webservers' that are not in the 'drain' subgroup. Which combination of filters correctly extracts these hosts?

Accepted Answer

{{ groups['webservers'] | difference(groups['drain']) }}. Option D is correct because the `difference` filter in Ansible returns the elements of the first list that are not present in the second list. This directly matches the requirement: all hosts in the 'webservers' group that are not in the 'drain' subgroup.

Answer

{{ groups['webservers'] | symmetric_difference(groups['drain']) }}

Answer

Answer

Question 13

Given `{{ ['1', '2', '3'] | map('int') | list }}`, what is the result?

Accepted Answer

`[1, 2, 3]`. The `map('int')` filter in Ansible/Jinja2 converts each string element in the list to an integer. The `list` filter then materializes the generator into a list, resulting in `[1, 2, 3]`. Option B is correct because this is the standard behavior of the `map` filter with the `int` function.

Answer

An error because 'int' is not a valid filter name.

Answer

`['1', '2', '3']` as integers, but stored as strings.

Answer

`['1', '2', '3']`

Question 14

An Ansible role uses a variable "server_list" which is a list of dictionaries. Each dictionary has a key "ports" which should be a list of integers. However, due to inconsistent input, "ports" could be a comma-separated string (e.g., "80,443") or already a list of integers (e.g., [80,443]). The engineer wants to normalize "ports" to always be a list of integers for further processing. Which of the following tasks correctly normalizes the "ports" field?

Accepted Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': (item.ports is string) | ternary(item.ports | split(','), item.ports)}) }}"
  loop: "{{ server_list }}". Option D is correct because it uses the `ternary` filter to check if `item.ports` is a string; if true, it splits the string by commas into a list, otherwise it keeps the existing list. This ensures the `ports` field is always normalized to a list of integers, handling both inconsistent input formats.

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports | split(',')}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': [item.ports] | flatten}) }}"
  loop: "{{ server_list }}"

Answer

- set_fact:
    server_list: "{{ server_list | map('combine', {'ports': item.ports}) }}"
  loop: "{{ server_list }}"

Question 15

What is the effect of the `filter_plugins` setting in `ansible.cfg`?

Accepted Answer

It replaces the default search path for filter plugins with the specified directory.. In Ansible, the `filter_plugins` setting in `ansible.cfg` specifies a directory that replaces the default search path for filter plugins. This means Ansible will look only in the specified directory for filter plugins, ignoring the default locations such as `~/.ansible/plugins/filter` or the `filter_plugins` directory relative to the playbook. This is a configuration override, not an addition.

Answer

It sets the directory for filter plugins but only for the current playbook.

Answer

It configures the path for lookup plugins, not filter plugins.

Answer

It adds the directory to the default search path for filter plugins.

Question 16

An administrator must parse an inventory file where hostnames are stored in YAML format under a list 'nodes'. The task needs to extract only hostnames that contain 'prod' in the name, then sort them in reverse order. Which combination of filters in a single Ansible expression achieves this?

Accepted Answer

nodes | select('match', '.*prod.*') | sort(reverse=True). Option A is correct because the `select` filter with the `match` test returns only list items that match the regex `'.*prod.*'`, i.e., hostnames containing 'prod'. The `sort(reverse=True)` then sorts the resulting list in descending alphabetical order, fulfilling both requirements in a single Ansible expression.

Answer

nodes | regex_search('prod') | sort(True)

Answer

nodes | map('regex_search', 'prod') | sort(reverse=True)

Answer

nodes | reject('match', '.*prod.*') | sort(reverse=True)

Question 17

A security team requires that all passwords in an Ansible vault be encrypted with a different key from the host variables. They want to use a custom lookup plugin that fetches secrets from an external API. Which plugin type should be developed?

Accepted Answer

Lookup plugin. A lookup plugin is the correct choice because it is designed to retrieve data from external sources (like an API) and return it as a string or list for use in Ansible playbooks. This aligns with the requirement to fetch secrets from an external API, and lookup plugins can be used directly in variables or templates without modifying the host state.

Answer

Module

Answer

Action plugin

Answer

Filter plugin

Question 18

A large-scale Ansible deployment processes a list of thousands of network devices. Using the `subelements` filter to iterate over interfaces is causing very slow playbook execution. Which approach can significantly improve performance?

Accepted Answer

Use a custom filter plugin in Python that uses list comprehensions. The `subelements` filter in Ansible processes nested data structures by iterating over each parent element and its child elements, which can be extremely slow for large datasets due to the overhead of Jinja2 template evaluation and repeated lookups. A custom filter plugin written in Python using list comprehensions avoids this overhead by executing native Python code directly, which is significantly faster because it operates at the interpreter level without the iterative Jinja2 expansion. This approach reduces the number of tasks and template evaluations, improving performance for thousands of network devices.

Answer

Use `with_nested` instead

Answer

Use `set_fact` with loops inside the task

Answer

Use `with_items` with `json_query` instead

Question 19

An Ansible Tower administrator notices that a job template using a dynamic inventory source from AWS EC2 is not updating when new instances are launched. The inventory source is set to update on launch. What is the most likely cause?

Accepted Answer

The AWS credential associated with the inventory source is invalid or expired.. Option B is correct because the most likely cause of a dynamic inventory source not updating is that the associated AWS credential is invalid or expired. When the 'update on launch' option is enabled, Ansible Tower attempts to refresh the inventory from the source before each job run. If the credential (e.g., AWS access key ID and secret access key) is no longer valid, the inventory update will fail silently or with an error, and the job will use stale cached data.

Answer

The inventory source cache timeout is set too high.

Answer

The 'update on launch' option is disabled.

Answer

The inventory source is configured as a custom script.

Question 20

An Ansible Tower administrator needs to create a custom credential type that uses an SSH private key and a username. Which THREE components should be defined in the credential type's configuration?

Accepted Answer

"fields": [{"id": "ssh_key_data", "type": "string", "label": "SSH Private Key", "multiline": true, "secret": true}]. Option A is correct because the SSH private key must be defined as a field with `"type": "string"`, `"multiline": true` (since SSH keys are multi-line), and `"secret": true` (to encrypt the value in the database). This matches the standard Ansible Tower custom credential type schema for storing sensitive key material.

Answer

"fields": [{"id": "password", "type": "string", "label": "Password"}]

Answer

"fields": [{"id": "key_type", "type": "string", "label": "Key Type"}]