EX294 Manage inventories and credentials Practice Test 2 — 15 Questions

Question 1

A team is configuring an inventory to manage Windows hosts via Ansible. Which TWO inventory variables must be defined for each host?

Accepted Answer

ansible_host. `ansible_host` defines the IP address or FQDN that Ansible uses to connect to the managed host. For Windows hosts, this is essential because Ansible cannot rely on the inventory hostname alone (which may be a short name or not resolvable). Option E is correct because `ansible_connection` must be set to `winrm` for Windows hosts; without it, Ansible defaults to SSH, which will fail against Windows targets.

Answer

ansible_shell_type

Answer

ansible_user

Answer

ansible_winrm_server_cert_validation

Question 2

An Ansible playbook uses the `fetch` module to retrieve files from managed hosts. Which TWO inventory variables are commonly used to construct unique destination paths for each host?

Accepted Answer

inventory_hostname. The `fetch` module retrieves files from managed hosts and stores them locally. To avoid overwriting files from different hosts, you must use unique destination paths. `inventory_hostname` provides the hostname as defined in the inventory, and `ansible_host` provides the actual IP or FQDN used to connect, both of which are commonly used to create distinct per-host directories or filenames.

Answer

dest

Answer

hostvars

Answer

group_names

Question 3

Refer to the exhibit. A playbook runs against the `web` group. What username will be used for host web2?

Accepted Answer

deploy. The playbook runs against the `web` group, and host `web2` inherits the `ansible_user` variable from the group-level inventory definition. In Ansible, the `ansible_user` variable determines the SSH username for the connection. Since the exhibit (not shown here but implied) sets `ansible_user: deploy` for the `web` group, all hosts in that group, including `web2`, will use `deploy` as the SSH username unless overridden at the host level.

Answer

undetermined

Answer

admin

Answer

root

Question 4

Refer to the exhibit. An Ansible playbook targeting server1 fails with a permissions error when connecting. The administrator notices the SSH private key is being used. Which change will likely fix the issue?

Accepted Answer

Change ansible_user to 'ec2-user'.. The error indicates that the SSH private key being used does not correspond to the user attempting to connect. In many cloud environments like AWS, the default user for Amazon Linux 2 is 'ec2-user', and the SSH private key is tied to that user. Changing `ansible_user` to 'ec2-user' ensures the correct user context for key-based authentication, resolving the permissions error.

Answer

Add `ansible_become: yes` to the playbook.

Answer

Remove ansible_ssh_common_args.

Answer

Set ansible_ssh_private_key_file to a different key.

Question 5

A company uses a static inventory file for Ansible Tower. They need to add a new host to an existing group. Which action should they take?

Accepted Answer

Edit the inventory in the Tower UI and add the host to the group.. The company uses a static inventory file for Ansible Tower, and the Tower UI provides a built-in interface to manage static inventories. Editing the inventory in the Tower UI and adding the host to the group directly updates the underlying static inventory file and synchronizes it with Tower's database, ensuring the host is available for job runs without manual file manipulation.

Answer

Use the ansible-inventory command to add the host.

Answer

Modify the static inventory file and run a job template.

Answer

Create a new inventory and host group.

Question 6

An administrator needs to store a database password securely for use in playbooks. Which credential type should they create?

Accepted Answer

Vault credential. A Vault credential is the correct choice because Ansible Vault is specifically designed to encrypt sensitive data like passwords, API keys, and other secrets used in playbooks. It allows the administrator to store the database password in an encrypted file that can be decrypted at runtime using a vault password, ensuring the secret is not exposed in plaintext in the playbook or inventory.

Answer

Source control credential

Answer

Machine credential

Answer

Network credential

Question 7

An organization has multiple inventories for different environments. They want to reuse a set of hosts across inventories without duplicating host definitions. Which feature should they use?

Accepted Answer

Smart inventories. Smart inventories allow you to define a set of hosts based on a search query (e.g., using hostname patterns or Ansible facts) that can span multiple inventories. This enables reuse of host definitions across different environments without duplicating them, as the smart inventory dynamically resolves the host list at runtime from the underlying inventory sources.

Answer

Inventory sources

Answer

Shared inventories

Answer

Inventory groups

Question 8

A playbook requires a secret token that changes every hour. The token is stored in a password vault. Which setting should be used to have Tower retrieve the token at runtime?

Accepted Answer

Use a custom credential type that injects the vault lookup result.. Ansible Tower (now Red Hat Ansible Automation Platform) supports custom credential types that can define input and injector configurations. By using a custom credential type with an injector that includes a lookup plugin (e.g., `{{ lookup('hashi_vault', 'secret/data/token') }}`), Tower can retrieve the secret token from a password vault (like HashiCorp Vault) at runtime, ensuring the token is always current without hard-coding or manual updates.

Answer

Hard-code the token in the playbook.

Answer

Store the token in extra_vars on the job template.

Answer

Store the token in the project as a file.

Question 9

A team is using Ansible Tower with multiple credentials per job template. The playbook uses the 'become' method to escalate privileges on remote hosts. The become password is different from the SSH password. Which configuration ensures the become password is used?

Accepted Answer

Provide both the SSH password and become password in the machine credential.. In Ansible Tower, when a job template uses multiple credentials, the machine credential is the primary credential for SSH authentication. To use a different become password, you must provide both the SSH password and the become password within the same machine credential. This is because the machine credential has dedicated fields for 'Password' (SSH) and 'Become Password' (privilege escalation), and Tower automatically uses the become password from that credential when the playbook invokes 'become: yes'.

Answer

Use a vault credential to store the become password.

Answer

Use two separate credentials (one for SSH, one for become) and assign both to the job template.

Answer

Store the become password in inventory variables.

Question 10

A job template uses a custom credential type that injects environment variables for a third-party API. The credential input defines a field 'api_key'. The playbook uses {{ api_key }} but it's empty. What is the most likely cause?

Accepted Answer

The injector configuration is missing or incorrect.. The most likely cause is that the injector configuration is missing or incorrect. In Ansible Tower/AWX, a custom credential type requires an injector definition (e.g., `env` or `file`) to map the credential input fields into environment variables or extra vars. Without a proper injector, the `api_key` field is never exposed to the job environment, so `{{ api_key }}` resolves to an empty string.

Answer

The field name is case-sensitive and the playbook uses a different case.

Answer

The credential was not assigned to the job template.

Answer

The playbook uses a different variable name.

Question 11

An Ansible Tower administrator notices that a job template using a dynamic inventory source from AWS EC2 is not updating when new instances are launched. The inventory source is set to update on launch. What is the most likely cause?

Accepted Answer

The AWS credential associated with the inventory source is invalid or expired.. The most likely cause of a dynamic inventory source not updating is that the associated AWS credential is invalid or expired. When the 'update on launch' option is enabled, Ansible Tower attempts to refresh the inventory from the source before each job run. If the credential (e.g., AWS access key ID and secret access key) is no longer valid, the inventory update will fail silently or with an error, and the job will use stale cached data.

Answer

The inventory source cache timeout is set too high.

Answer

The 'update on launch' option is disabled.

Answer

The inventory source is configured as a custom script.

Question 12

Which TWO actions are valid for managing inventory group membership in Ansible Tower?

Accepted Answer

Assigning a host to multiple groups.. Ansible Tower allows a host to be a member of multiple groups simultaneously, enabling flexible inventory organization and variable inheritance. Option E is correct because host variables override group variables when the same key is defined at both levels, following Ansible's variable precedence rules.

Answer

Using a range expression in the inventory host file.

Answer

Deleting a group deletes all hosts in it.

Answer

Creating a group as a child of itself.

Question 13

Which THREE are valid credential types in Ansible Tower?

Accepted Answer

Network credential. In Ansible Tower (now Red Hat Ansible Automation Platform controller), credentials are typed by the target or service they authenticate to, and the five listed types are all valid. A. Network credential is correct because it stores credentials for connecting to network devices (e.g., via network_cli or netconf) such as SSH or enable passwords. B. Machine credential is correct because it holds SSH keys or passwords used to log into managed Linux/Unix hosts. C. Source control credential is correct because it stores SCM login details (username/password or SSH key/token) so projects can be fetched from Git, Subversion, or Mercurial. D. Cloud credential is correct because it holds provider-specific authentication (e.g., AWS access key/secret key, Azure service principal, GCP service account) for cloud inventory and modules. E. Vault credential is correct because it stores the password or vault password file used to decrypt Ansible Vault-encrypted content. No listed option is unmarked, so all five are valid credential types.

Question 14

An Ansible Tower administrator wants to allow a team to run playbooks against a set of production web servers without giving them direct SSH access to the hosts. Which inventory configuration approach should be used?

Accepted Answer

Create a smart inventory and use the 'prod_web' tag to filter hosts. Smart inventories in Ansible Tower allow you to define a dynamic set of hosts based on a filter, such as a tag (e.g., 'prod_web'). This enables the team to run playbooks against production web servers without granting them direct SSH access to the hosts, as Tower manages the SSH connections centrally using its own credentials.

Answer

Use the ad hoc inventory feature to specify hosts at launch time

Answer

Define a group variable for production web servers in the inventory

Answer

Create a static inventory and add each web server manually

Question 15

An organization uses multiple Ansible Automation Platform clusters in different geographies. Each cluster has its own set of credentials for different environments. An administrator needs to ensure that job templates launched in the EMEA cluster can only use EMEA-specific credentials, while the APAC cluster uses APAC-specific credentials, without duplicating job template definitions. What is the best approach?

Accepted Answer

Configure separate organizations for each cluster and assign credentials to each organization, then use the same job template within each organization. Ansible Automation Platform organizations provide a logical boundary for credentials, projects, and job templates. By creating separate organizations for the EMEA and APAC clusters, the administrator can assign EMEA-specific credentials to the EMEA organization and APAC-specific credentials to the APAC organization. The same job template can then be created within each organization, inheriting only the credentials assigned to that organization, thus avoiding duplication of the job template definition while enforcing credential isolation.

Answer

Create separate job templates for each cluster and assign the appropriate credentials

Answer

Use the same job template and rely on host tags in the inventory to filter which credentials are used

Answer

Use an external secrets management system and call it via lookup plugin in the playbook