EX294 Manage inventories and credentials Practice Test 2 — 15 Questions

Question 1

An administrator wants to use a custom inventory script to dynamically generate hosts in Ansible Tower. Which of the following is a valid approach to manage credentials for accessing the script's API?

Accepted Answer

Define environment variables in the job template that references the inventory script, and use a credential type that injects those variables.. Option A is correct because Ansible Tower (now Red Hat Ansible Automation Platform) allows custom credential types to inject environment variables into job runs. When a custom inventory script requires API authentication, you can define a credential type with injector configuration that sets environment variables (e.g., API_TOKEN, API_USER), then attach that credential to the job template. This keeps secrets out of scripts and repositories, following security best practices.

Answer

Attach the credential directly to the inventory script in the Ansible Tower UI.

Answer

Store the API token in a file within the project repository and source it in the script.

Answer

Embed the API token within the inventory script's JSON output.

Question 2

Which TWO of the following are valid methods to manage credentials in Ansible Tower?

Accepted Answer

Integrate with an external secrets management system using a credential lookup plugin.. Option A is correct because Ansible Tower (now Red Hat Ansible Automation Platform) supports integration with external secrets management systems like HashiCorp Vault, CyberArk, or Azure Key Vault via credential lookup plugins. This allows Tower to retrieve secrets dynamically at runtime without storing them in the Tower database, aligning with security best practices.

Answer

Export credentials from the Ansible Tower API in plain-text.

Answer

Use machine credentials with an SSH key that has a passphrase.

Answer

Store credentials in plain-text in the Ansible Tower database.

Question 3

Drag and drop the steps to create and apply a simple Ansible playbook that installs httpd into the correct order.

Question 4

Drag and drop the steps to configure a systemd service to start automatically at boot in the correct order.

Question 5

Match each Linux file system path to its typical content.

Question 6

Match each storage concept to its description.

Question 7

A systems administrator needs to use a different SSH private key for a group of hosts in an Ansible inventory. Which inventory variable should be set at the group level?

Accepted Answer

ansible_ssh_private_key_file. Option B is correct because `ansible_ssh_private_key_file` is the Ansible inventory variable that specifies the path to the SSH private key file for a host or group. When set at the group level, it applies to all hosts in that group, allowing the administrator to use a different key for authentication without modifying individual host definitions.

Answer

ansible_ssh_key

Answer

ansible_ssh_key_file

Answer

ansible_private_key

Question 8

An Ansible Tower/AWX administrator wants to prevent users from viewing credential passwords in plain text. Which credential type should be used for SSH passwords?

Accepted Answer

Machine credential. Machine credentials in Ansible Tower/AWX are the correct choice for SSH passwords because they are specifically designed to store SSH authentication parameters, including passwords, private keys, and key passphrases. When a machine credential is configured with an SSH password, Tower/AWX encrypts the password at rest and never exposes it in plain text to users through the web interface or API, ensuring that credential secrets remain hidden.

Answer

SSH credential

Answer

Password credential

Answer

Login credential

Question 9

A DevOps engineer is designing a dynamic inventory script for a cloud provider. The script must return host variables in a specific JSON format. According to Ansible best practices, which top-level keys should be present in the script output?

Accepted Answer

Group names as keys, each containing 'hosts' and 'vars'. Ansible dynamic inventory scripts must return JSON with group names as top-level keys, each containing 'hosts' (a list of hostnames) and optionally 'vars' (dictionary of group variables). This structure allows Ansible to map hosts to groups and apply group-level variables, which is essential for inventory organization and playbook targeting. Option A correctly describes this required format per Ansible best practices.

Answer

all, groups, hosts

Answer

List of host objects

Answer

inventory, hosts, vars

Question 10

An Ansible administrator wants to use an encrypted vault file to store sensitive variables. Which command creates a new vault file and prompts for a password?

Accepted Answer

ansible-vault create secrets.yml. Option B is correct because `ansible-vault create secrets.yml` creates a new encrypted vault file and immediately prompts the user to set a password, which is then used to encrypt the file. This command is specifically designed for initial creation of vault files, unlike `edit` which requires an existing file, `view` which only displays content, or `encrypt` which encrypts an existing plaintext file.

Answer

ansible-vault edit secrets.yml

Answer

ansible-vault view secrets.yml

Answer

ansible-vault encrypt secrets.yml

Question 11

A team uses Ansible AWX and needs to run a job template that uses a custom credential of type 'OpenStack' to authenticate to an OpenStack cloud. Which field in the job template is used to specify this credential?

Accepted Answer

Credential. In Ansible AWX, the 'Credential' field in a job template is used to specify the primary credential for authentication to external systems. When using a custom credential type like 'OpenStack', selecting it in the 'Credential' field associates the job template with the OpenStack authentication parameters (e.g., auth URL, username, password, project) defined in that credential. This allows the job to authenticate to the OpenStack cloud during execution.

Answer

Custom Credential

Answer

Extra Credentials

Answer

Machine credential

Question 12

An Ansible playbook uses the `ansible_user` variable at the host level, but the SSH connection still uses root. Which configuration setting could override the playbook's user setting?

Accepted Answer

The Machine credential assigned to the job template specifies a different username.. In Ansible Tower/AWX, Machine credentials assigned to a job template take precedence over playbook-level variables like `ansible_user`. When a credential specifies a different username, it overrides the host variable because the credential system injects authentication parameters at runtime, effectively replacing the playbook's user setting for SSH connections.

Answer

The organization default user is root.

Answer

The playbook uses the directive 'remote_user: root'.

Answer

The inventory host variable ansible_user is not set.

Question 13

A junior admin wants to remove a credential from Ansible Tower. Which role-based access control permission is required to delete a credential?

Accepted Answer

Admin. In Ansible Tower, the Admin role is the only role that grants full management permissions, including the ability to delete credentials. Lower-level roles like Read, Use, and Execute only allow viewing or using credentials, not modifying or deleting them. This aligns with Tower's RBAC hierarchy where Admin is required for destructive actions on any resource.

Answer

Read

Answer

Use

Answer

Execute

Question 14

An Ansible inventory file uses the `gce.py` dynamic inventory script for Google Cloud. After running the script, the inventory contains hosts but no variables. What is the most likely cause?

Accepted Answer

The script's JSON output lacks the 'vars' section for the group.. Option C is correct because dynamic inventory scripts like `gce.py` output JSON that must include a `_meta` section with `hostvars` for host-specific variables, and a `vars` subsection within each group to define group-level variables. If the script's JSON output lacks the `vars` section for a group, Ansible will still see the hosts but will not populate any variables for that group, resulting in hosts with no associated variables.

Answer

The script is not executable.

Answer

The GCE service account lacks permissions to read instance metadata.

Answer

The inventory file uses `hosts: all`.

Question 15

An Ansible playbook uses a vault-encrypted variable `db_password` from a vars file. The playbook fails with 'Decryption failed' error. Which of the following could be the cause?

Accepted Answer

The vault ID in the encrypted file does not match the provided vault ID.. Option C is correct because Ansible Vault supports multiple vault IDs, and the vault ID used to encrypt the variable must match the vault ID provided at runtime (via `--vault-id` or `ansible.cfg`). If the encrypted file was created with vault ID 'prod' but the playbook is run with vault ID 'dev', Ansible will fail with 'Decryption failed' because it cannot find a matching password for that ID.

Answer

The vault password is correct but the file is corrupted.

Answer

The vault password file path is incorrect in ansible.cfg.

Answer

The variable is not encrypted but marked as `!vault`.