EX294 Manage inventories and credentials Practice Test 2 — 15 Questions

Question 1

A company manages its infrastructure using Ansible Tower. There are two teams: Team Alpha manages web servers in the 'webservers' group, and Team Beta manages database servers in the 'dbservers' group. Both teams need to use the same SSH credential to connect to their respective servers. The credential is stored in Tower as 'shared_ssh_key'. Team Alpha reports that they can launch jobs against the 'webservers' group, but Team Beta gets an error when trying to launch jobs against the 'dbservers' group: 'You do not have permission to use this credential.' Both teams are members of the same organization. The inventory is a single inventory source with separate groups. The credential has been assigned to the organization. What is the most likely cause of Team Beta's issue, and what is the correct solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant Team Beta the 'Use' role on the credential 'shared_ssh_key'.. In Ansible Tower, credentials are assigned to an organization, but users or teams must be explicitly granted the 'Use' role on a credential to be able to use it in a job template. Team Alpha can use the credential because they likely have the 'Use' role, while Team Beta does not. Granting Team Beta the 'Use' role on 'shared_ssh_key' resolves the permission error.

Answer

Create a new credential with the same SSH key and assign it to Team Beta.

Answer

Assign the credential to the dbservers group in the inventory.

Answer

Move the credential from the organization to the project level.

Question 2

An administrator wants to use a custom inventory script to dynamically generate hosts in Ansible Tower. Which of the following is a valid approach to manage credentials for accessing the script's API?

Accepted Answer

Define environment variables in the job template that references the inventory script, and use a credential type that injects those variables.. Ansible Tower (now Red Hat Ansible Automation Platform) allows custom credential types to inject environment variables into job runs. When a custom inventory script requires API authentication, you can define a credential type with injector configuration that sets environment variables (e.g., API_TOKEN, API_USER), then attach that credential to the job template. This keeps secrets out of scripts and repositories, following security best practices.

Answer

Attach the credential directly to the inventory script in the Ansible Tower UI.

Answer

Store the API token in a file within the project repository and source it in the script.

Answer

Embed the API token within the inventory script's JSON output.

Question 3

Which TWO of the following are valid methods to manage credentials in Ansible Tower?

Accepted Answer

Integrate with an external secrets management system using a credential lookup plugin.. Ansible Tower (now Red Hat Ansible Automation Platform) supports integration with external secrets management systems like HashiCorp Vault, CyberArk, or Azure Key Vault via credential lookup plugins. This allows Tower to retrieve secrets dynamically at runtime without storing them in the Tower database, aligning with security best practices.

Answer

Export credentials from the Ansible Tower API in plain-text.

Answer

Use machine credentials with an SSH key that has a passphrase.

Answer

Store credentials in plain-text in the Ansible Tower database.

Question 4

Drag and drop the steps to create and apply a simple Ansible playbook that installs httpd into the correct order.

Accepted Answer

Create the playbook file, then define hosts and tasks, then execute the playbook, then verify the httpd service.. A playbook defines hosts and tasks; tasks use modules; after execution, verification confirms success.

Answer

Define hosts and tasks, then create the playbook file, then execute the playbook, then verify the httpd service.

Answer

Create the playbook file, then execute the playbook, then verify the httpd service, then define hosts and tasks.

Answer

Execute the playbook, then create the playbook file, then define hosts and tasks, then verify the httpd service.

Question 5

Drag and drop the steps to configure a systemd service to start automatically at boot in the correct order.

Accepted Answer

Create unit file, Reload systemd, Enable service, Start service, Verify status. The correct sequence for configuring a systemd service to start at boot is: first create the unit file, then reload systemd to load the new unit, next enable the service to create the necessary symlinks for automatic start, then start the service immediately, and finally verify its status. Common mistakes include omitting the reload step, enabling after starting, or performing the reload too late.

Answer

Create unit file, Enable service, Start service, Verify status

Answer

Create unit file, Reload systemd, Start service, Enable service, Verify status

Answer

Create unit file, Start service, Enable service, Reload systemd, Verify status

Question 6

Match each Linux file system path to its typical content.

Accepted Answer

/etc: Configuration files for the system and applications. In Red Hat Enterprise Linux, standard directories follow the Filesystem Hierarchy Standard (FHS). /etc holds configuration files, /home stores user home directories, and /boot contains boot loader files and kernel images. Common confusions include mixing /var (variable data like logs) with /tmp (temporary files) and associating log files incorrectly with /tmp.

Answer

/var: Temporary files

Answer

/tmp: Log files

Question 7

Match each storage concept to its description.

Accepted Answer

LVM: Allows flexible disk management with volume groups and logical volumes. The correct matches are: LVM for flexible disk management with VGs and LVs, RAID for combining disks for redundancy/performance, Stratis for pool-based snapshots and thin provisioning, and VDO for block-level deduplication/compression. Common confusions include swapping LVM with VDO and RAID with Stratis.

Answer

LVM: Deduplicates and compresses data at the block level

Answer

RAID: Provides thin provisioning and snapshots using a pool-based model

Question 8

A systems administrator needs to use a different SSH private key for a group of hosts in an Ansible inventory. Which inventory variable should be set at the group level?

Accepted Answer

ansible_ssh_private_key_file. `ansible_ssh_private_key_file` is the Ansible inventory variable that specifies the path to the SSH private key file for a host or group. When set at the group level, it applies to all hosts in that group, allowing the administrator to use a different key for authentication without modifying individual host definitions.

Answer

ansible_ssh_key

Answer

ansible_ssh_key_file

Answer

ansible_private_key

Question 9

An Ansible Tower/AWX administrator wants to prevent users from viewing credential passwords in plain text. Which credential type should be used for SSH passwords?

Accepted Answer

Machine credential. Machine credentials in Ansible Tower/AWX are the correct choice for SSH passwords because they are specifically designed to store SSH authentication parameters, including passwords, private keys, and key passphrases. When a machine credential is configured with an SSH password, Tower/AWX encrypts the password at rest and never exposes it in plain text to users through the web interface or API, ensuring that credential secrets remain hidden.

Answer

SSH credential

Answer

Password credential

Answer

Login credential

Question 10

A DevOps engineer is designing a dynamic inventory script for a cloud provider. The script must return host variables in a specific JSON format. According to Ansible best practices, which top-level keys should be present in the script output?

Accepted Answer

Group names as keys, each containing 'hosts' and 'vars'. Ansible dynamic inventory scripts must return JSON with group names as top-level keys, each containing 'hosts' (a list of hostnames) and optionally 'vars' (dictionary of group variables). This structure allows Ansible to map hosts to groups and apply group-level variables, which is essential for inventory organization and playbook targeting. Option A correctly describes this required format per Ansible best practices.

Answer

all, groups, hosts

Answer

List of host objects

Answer

inventory, hosts, vars

Question 11

An Ansible administrator wants to use an encrypted vault file to store sensitive variables. Which command creates a new vault file and prompts for a password?

Accepted Answer

ansible-vault create secrets.yml. `ansible-vault create secrets.yml` creates a new encrypted vault file and immediately prompts the user to set a password, which is then used to encrypt the file. This command is specifically designed for initial creation of vault files, unlike `edit` which requires an existing file, `view` which only displays content, or `encrypt` which encrypts an existing plaintext file.

Answer

ansible-vault edit secrets.yml

Answer

ansible-vault view secrets.yml

Answer

ansible-vault encrypt secrets.yml

Question 12

A team uses Ansible AWX and needs to run a job template that uses a custom credential of type 'OpenStack' to authenticate to an OpenStack cloud. Which field in the job template is used to specify this credential?

Accepted Answer

Credential. In Ansible AWX, the 'Credential' field in a job template is used to specify the primary credential for authentication to external systems. When using a custom credential type like 'OpenStack', selecting it in the 'Credential' field associates the job template with the OpenStack authentication parameters (e.g., auth URL, username, password, project) defined in that credential. This allows the job to authenticate to the OpenStack cloud during execution.

Answer

Custom Credential

Answer

Extra Credentials

Answer

Machine credential

Question 13

An Ansible playbook uses the `ansible_user` variable at the host level, but the SSH connection still uses root. Which configuration setting could override the playbook's user setting?

Accepted Answer

The Machine credential assigned to the job template specifies a different username.. In Ansible Tower/AWX, Machine credentials assigned to a job template take precedence over playbook-level variables like `ansible_user`. When a credential specifies a different username, it overrides the host variable because the credential system injects authentication parameters at runtime, effectively replacing the playbook's user setting for SSH connections.

Answer

The organization default user is root.

Answer

The playbook uses the directive 'remote_user: root'.

Answer

The inventory host variable ansible_user is not set.

Question 14

A junior admin wants to remove a credential from Ansible Tower. Which role-based access control permission is required to delete a credential?

Accepted Answer

Admin. In Ansible Tower, the Admin role is the only role that grants full management permissions, including the ability to delete credentials. Lower-level roles like Read, Use, and Execute only allow viewing or using credentials, not modifying or deleting them. This aligns with Tower's RBAC hierarchy where Admin is required for destructive actions on any resource.

Answer

Read

Answer

Use

Answer

Execute

Question 15

An Ansible inventory file uses the `gce.py` dynamic inventory script for Google Cloud. After running the script, the inventory contains hosts but no variables. What is the most likely cause?

Accepted Answer

The script's JSON output lacks the 'vars' section for the group.. Dynamic inventory scripts like `gce.py` output JSON that must include a `_meta` section with `hostvars` for host-specific variables, and a `vars` subsection within each group to define group-level variables. If the script's JSON output lacks the `vars` section for a group, Ansible will still see the hosts but will not populate any variables for that group, resulting in hosts with no associated variables.

Answer

The script is not executable.

Answer

The GCE service account lacks permissions to read instance metadata.

Answer

The inventory file uses `hosts: all`.