EX294 Manage inventories and credentials — 30 Questions

Question 1

An administrator needs to store a secret API token in Ansible Automation Controller so that it can be used in job templates without exposing the token in plain text. Which type of credential should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vault credential. A Vault credential in Ansible Automation Controller stores an encrypted password that can be used to decrypt Ansible Vault files. While originally designed for vault files, it can also be used to securely store any secret, such as an API token, by referencing it via the {{ vault_password }} variable in job templates. This ensures the token is never exposed in plain text. Machine credentials are for SSH authentication, Network credentials for network devices, and Cloud credentials for cloud provider APIs—none are suitable for storing arbitrary API tokens.

Answer

Machine credential

Answer

Network credential

Answer

Cloud credential

Question 2

Which TWO of the following are valid methods to supply a credential password in Ansible Automation Controller?

Accepted Answer

Prompt on launch (ask for credential on job run). Option A is correct because Automation Controller supports the 'Prompt on launch' setting on credentials, which makes the job template ask the user for the credential password at job run time instead of storing it, and this is a documented way to supply a password. Option E is correct because a Vault credential in Automation Controller is used to supply the vault password (or vault password file) that decrypts vault-encrypted variables/content, which is a valid method for supplying a credential password to a job. Option B is not a supported mechanism: job templates do not have a setting to inject a credential password via an environment variable; environment variables in Automation Controller are used for other purposes and would not securely supply a credential password. Option C is not valid because storing a password in a file in the project repository exposes the secret in source control and is not a supported credential-supply method. Option D is not valid because Automation Controller encrypts credential inputs and does not support storing a credential password in plain text in the credential definition.

Answer

Set the password via an environment variable in the job template

Answer

Include the password in a file in the project repository

Answer

Store the password in plain text in the credential definition

Question 3

The job template running against host db1 uses a machine credential with an SSH key. The key is correctly configured in Automation Controller. However, the job fails with the error shown. What is the most likely cause?

Accepted Answer

The SSH public key corresponding to the private key is not installed on the target host. The error indicates that Automation Controller cannot authenticate to host db1 using the SSH key. Since the key is correctly configured in the controller, the most likely cause is that the corresponding public key is not present in the target host's ~/.ssh/authorized_keys file. SSH key-based authentication requires the private key on the client (controller) and the public key installed on the target host; without the public key, the server rejects the connection attempt.

Answer

The vault password is incorrect

Answer

The SSH port is blocked by a firewall

Answer

The host's SSH host key has changed and the known_hosts file is outdated

Question 4

A company uses Ansible Automation Controller to manage a mix of Linux and Windows servers. Each server is in a separate inventory group. The Linux servers use SSH keys stored in machine credentials, and the Windows servers use username/password stored in machine credentials. Recently, a new security policy requires that all credentials must be rotated every 90 days. The automation team has 50 Linux servers and 20 Windows servers. They want to minimize manual effort and avoid exposing secrets in plain text during rotation. They currently have a Jenkins pipeline that can run scripts on the controller node. Which approach best meets the requirements?

Accepted Answer

Write a script that uses the Automation Controller API to update the credential's inputs (e.g., new SSH key or password) after rotating them on the target servers. It uses the Automation Controller API to programmatically update credential inputs (SSH keys or passwords) after rotating them on the target servers, which minimizes manual effort, avoids exposing secrets in plain text (the API call uses HTTPS and authentication tokens), and satisfies the 90-day rotation policy. The Jenkins pipeline can invoke a script that first rotates the secret on each server (e.g., via SSH or WinRM) and then calls the API's PATCH endpoint for the credential to update the stored value, ensuring the credential remains synchronized without manual UI intervention.

Answer

Use a Vault credential to store the new secrets and reference them in the job template

Answer

Store the new passwords directly in a playbook and run it manually on each server, then update the credential in the UI

Answer

Create a single machine credential with the same SSH key for all Linux servers and a single credential for all Windows servers

Question 5

A system administrator is managing Ansible Tower and wants to use an Azure Resource Manager credential to provision virtual machines. However, the credential fails authentication with the error '401 Unauthorized'. Which action should the administrator take to resolve the issue?

Accepted Answer

Verify the client secret in the credential matches the one configured in Azure Active Directory.. The 401 Unauthorized error when using an Azure Resource Manager credential in Ansible Tower indicates that the authentication token or secret used to authenticate with Microsoft Entra ID is invalid or mismatched. Option B is correct because verifying that the client secret stored in the Tower credential exactly matches the one configured in Microsoft Entra ID resolves the authentication failure, as Microsoft Entra ID uses OAuth 2.0 client credentials flow where the client secret is required for token acquisition.

Answer

Regenerate the SSH key pair and update the credential.

Answer

Add the credential as a playbook-level variable instead of a Tower credential.

Answer

Generate a new API token from Azure and paste it into the credential.

Question 6

An Ansible Tower administrator needs to allow a team of developers to run playbooks against specific inventory groups without allowing them to modify the inventory or credentials. Which approach best satisfies the requirement?

Accepted Answer

Assign the developers the 'Execute' role on the inventory and 'Use' role on the credential.. The 'Execute' role on an inventory allows a user to run playbooks against that inventory without granting permission to modify its contents. The 'Use' role on a credential permits the credential to be used in job templates but not viewed or edited. This combination precisely meets the requirement of allowing playbook execution while preventing inventory or credential modification.

Answer

Assign the developers the 'Update' role on the inventory and 'Admin' role on the credential.

Answer

Assign the developers the 'Admin' role on the inventory and 'Read' role on the credential.

Answer

Assign the developers the 'Read' role on both inventory and credential.

Question 7

An administrator wants to use a custom inventory script to dynamically generate hosts in Ansible Tower. Which of the following is a valid approach to manage credentials for accessing the script's API?

Accepted Answer

Define environment variables in the job template that references the inventory script, and use a credential type that injects those variables.. Ansible Tower (now Red Hat Ansible Automation Platform) allows custom credential types to inject environment variables into job runs. When a custom inventory script requires API authentication, you can define a credential type with injector configuration that sets environment variables (e.g., API_TOKEN, API_USER), then attach that credential to the job template. This keeps secrets out of scripts and repositories, following security best practices.

Answer

Attach the credential directly to the inventory script in the Ansible Tower UI.

Answer

Store the API token in a file within the project repository and source it in the script.

Answer

Embed the API token within the inventory script's JSON output.

Question 8

Which TWO of the following are valid methods to manage credentials in Ansible Tower?

Accepted Answer

Integrate with an external secrets management system using a credential lookup plugin.. Option A is correct because Ansible Tower (AWX/Ansible Automation Platform) supports credential lookup plugins that allow job templates to retrieve secrets dynamically from external secrets management systems such as HashiCorp Vault, CyberArk, or AWS Secrets Manager, keeping sensitive data out of Tower itself. Option D is correct because Tower allows administrators to define custom credential types that specify input fields and injectors, which can expose credential values as environment variables (or extra variables) inside job templates, enabling flexible integration with third-party tools. Option B is wrong because the Tower API never returns credential secrets in plain text; secrets are write-only and encrypted at rest. Option C is wrong because while machine credentials can use SSH keys, a passphrase-protected key is not itself a credential management method and requires additional handling. Option E is wrong because Tower encrypts credentials in its database using its SECRET_KEY; storing them in plain text is neither supported nor a valid management method.

Answer

Export credentials from the Ansible Tower API in plain-text.

Answer

Use machine credentials with an SSH key that has a passphrase.

Answer

Store credentials in plain-text in the Ansible Tower database.

Question 9

Drag and drop the steps to create and apply a simple Ansible playbook that installs httpd into the correct order.

Accepted Answer

Create the playbook file, then define hosts and tasks, then execute the playbook, then verify the httpd service.. A playbook defines hosts and tasks; tasks use modules; after execution, verification confirms success.

Answer

Define hosts and tasks, then create the playbook file, then execute the playbook, then verify the httpd service.

Answer

Create the playbook file, then execute the playbook, then verify the httpd service, then define hosts and tasks.

Answer

Execute the playbook, then create the playbook file, then define hosts and tasks, then verify the httpd service.

Question 10

An Ansible Tower/AWX administrator wants to prevent users from viewing credential passwords in plain text. Which credential type should be used for SSH passwords?

Accepted Answer

Machine credential. Machine credentials in Ansible Tower/AWX are the correct choice for SSH passwords because they are specifically designed to store SSH authentication parameters, including passwords, private keys, and key passphrases. When a machine credential is configured with an SSH password, Tower/AWX encrypts the password at rest and never exposes it in plain text to users through the web interface or API, ensuring that credential secrets remain hidden.

Answer

SSH credential

Answer

Password credential

Answer

Login credential

Question 11

A DevOps engineer is designing a dynamic inventory script for a cloud provider. The script must return host variables in a specific JSON format. According to Ansible best practices, which top-level keys should be present in the script output?

Accepted Answer

Group names as keys, each containing 'hosts' and 'vars'. Ansible dynamic inventory scripts must return JSON with group names as top-level keys, each containing 'hosts' (a list of hostnames) and optionally 'vars' (dictionary of group variables). This structure allows Ansible to map hosts to groups and apply group-level variables, which is essential for inventory organization and playbook targeting. Option A correctly describes this required format per Ansible best practices.

Answer

all, groups, hosts

Answer

List of host objects

Answer

inventory, hosts, vars

Question 12

A team uses Ansible AWX and needs to run a job template that uses a custom credential of type 'OpenStack' to authenticate to an OpenStack cloud. Which field in the job template is used to specify this credential?

Accepted Answer

Credential. In Ansible AWX, the 'Credential' field in a job template is used to specify the primary credential for authentication to external systems. When using a custom credential type like 'OpenStack', selecting it in the 'Credential' field associates the job template with the OpenStack authentication parameters (e.g., auth URL, username, password, project) defined in that credential. This allows the job to authenticate to the OpenStack cloud during execution.

Answer

Custom Credential

Answer

Extra Credentials

Answer

Machine credential

Question 13

An Ansible playbook uses the `ansible_user` variable at the host level, but the SSH connection still uses root. Which configuration setting could override the playbook's user setting?

Accepted Answer

The Machine credential assigned to the job template specifies a different username.. In Ansible Tower/AWX, Machine credentials assigned to a job template take precedence over playbook-level variables like `ansible_user`. When a credential specifies a different username, it overrides the host variable because the credential system injects authentication parameters at runtime, effectively replacing the playbook's user setting for SSH connections.

Answer

The organization default user is root.

Answer

The playbook uses the directive 'remote_user: root'.

Answer

The inventory host variable ansible_user is not set.

Question 14

An Ansible inventory file uses the `gce.py` dynamic inventory script for Google Cloud. After running the script, the inventory contains hosts but no variables. What is the most likely cause?

Accepted Answer

The script's JSON output lacks the 'vars' section for the group.. Dynamic inventory scripts like `gce.py` output JSON that must include a `_meta` section with `hostvars` for host-specific variables, and a `vars` subsection within each group to define group-level variables. If the script's JSON output lacks the `vars` section for a group, Ansible will still see the hosts but will not populate any variables for that group, resulting in hosts with no associated variables.

Answer

The script is not executable.

Answer

The GCE service account lacks permissions to read instance metadata.

Answer

The inventory file uses `hosts: all`.

Question 15

An Ansible playbook uses a vault-encrypted variable `db_password` from a vars file. The playbook fails with 'Decryption failed' error. Which of the following could be the cause?

Accepted Answer

The vault ID in the encrypted file does not match the provided vault ID.. Ansible Vault supports multiple vault IDs, and the vault ID used to encrypt the variable must match the vault ID provided at runtime (via `--vault-id` or `ansible.cfg`). If the encrypted file was created with vault ID 'prod' but the playbook is run with vault ID 'dev', Ansible will fail with 'Decryption failed' because it cannot find a matching password for that ID.

Answer

The vault password is correct but the file is corrupted.

Answer

The vault password file path is incorrect in ansible.cfg.

Answer

The variable is not encrypted but marked as `!vault`.

Question 16

A team is configuring an inventory to manage Windows hosts via Ansible. Which TWO inventory variables must be defined for each host?

Accepted Answer

ansible_host. `ansible_host` defines the IP address or FQDN that Ansible uses to connect to the managed host. For Windows hosts, this is essential because Ansible cannot rely on the inventory hostname alone (which may be a short name or not resolvable). Option E is correct because `ansible_connection` must be set to `winrm` for Windows hosts; without it, Ansible defaults to SSH, which will fail against Windows targets.

Answer

ansible_shell_type

Answer

ansible_user

Answer

ansible_winrm_server_cert_validation

Question 17

An Ansible playbook uses the `fetch` module to retrieve files from managed hosts. Which TWO inventory variables are commonly used to construct unique destination paths for each host?

Accepted Answer

inventory_hostname. The `fetch` module retrieves files from managed hosts and stores them locally. To avoid overwriting files from different hosts, you must use unique destination paths. `inventory_hostname` provides the hostname as defined in the inventory, and `ansible_host` provides the actual IP or FQDN used to connect, both of which are commonly used to create distinct per-host directories or filenames.

Answer

dest

Answer

hostvars

Answer

group_names

Question 18

Refer to the exhibit. A playbook runs against the `web` group. What username will be used for host web2?

Accepted Answer

deploy. The playbook runs against the `web` group, and host `web2` inherits the `ansible_user` variable from the group-level inventory definition. In Ansible, the `ansible_user` variable determines the SSH username for the connection. Since the exhibit (not shown here but implied) sets `ansible_user: deploy` for the `web` group, all hosts in that group, including `web2`, will use `deploy` as the SSH username unless overridden at the host level.

Answer

undetermined

Answer

admin

Answer

root

Question 19

Refer to the exhibit. An Ansible playbook targeting server1 fails with a permissions error when connecting. The administrator notices the SSH private key is being used. Which change will likely fix the issue?

Accepted Answer

Change ansible_user to 'ec2-user'.. The error indicates that the SSH private key being used does not correspond to the user attempting to connect. In many cloud environments like AWS, the default user for Amazon Linux 2 is 'ec2-user', and the SSH private key is tied to that user. Changing `ansible_user` to 'ec2-user' ensures the correct user context for key-based authentication, resolving the permissions error.

Answer

Add `ansible_become: yes` to the playbook.

Answer

Remove ansible_ssh_common_args.

Answer

Set ansible_ssh_private_key_file to a different key.

Question 20

A company uses a static inventory file for Ansible Tower. They need to add a new host to an existing group. Which action should they take?

Accepted Answer

Edit the inventory in the Tower UI and add the host to the group.. The company uses a static inventory file for Ansible Tower, and the Tower UI provides a built-in interface to manage static inventories. Editing the inventory in the Tower UI and adding the host to the group directly updates the underlying static inventory file and synchronizes it with Tower's database, ensuring the host is available for job runs without manual file manipulation.

Answer

Use the ansible-inventory command to add the host.

Answer

Modify the static inventory file and run a job template.

Answer

Create a new inventory and host group.