EX294 Manage inventories and credentials Practice Test 3 — 15 Questions

Question 1

A junior admin created a custom credential type for a third-party API. When running a job that uses this credential, the job fails with 'type object 'Credentials' has no attribute' error. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'inputs' section in the credential type definition has a misconfigured field name. The error 'type object 'Credentials' has no attribute' typically occurs when the credential type definition's 'inputs' section references a field name that does not match the actual attribute expected by the credential plugin or injector. In Ansible Tower/AWX, the 'inputs' section defines the fields a user fills in (e.g., username, password), and if a field name is misspelled or mismatched with what the credential plugin expects, the plugin cannot find the attribute, causing this error. Option A is correct because a misconfigured field name in 'inputs' directly leads to this attribute lookup failure.

Answer

The 'injectors' section in the credential type definition is missing

Answer

The credential is not assigned to the job template

Answer

The job template is missing the required extra variables

Question 2

An administrator needs to restrict access to an inventory so that only members of the 'WebTeam' can update its host variables and group memberships. Other users should be able to view the inventory but not modify it. Which role-based access control (RBAC) configuration should be applied?

Accepted Answer

Assign the 'WebTeam' the 'admin' role on the inventory and others the 'read' role. In Ansible Tower/AWX, the 'admin' role on an inventory grants full update permissions (including host variables and group memberships), while the 'read' role provides view-only access. This directly satisfies the requirement that only WebTeam members can modify the inventory, and others can only view it.

Answer

Create a job template and assign 'WebTeam' the 'execute' role

Answer

Make the 'WebTeam' organization administrators and assign others the 'read' role on the organization

Answer

Assign the 'WebTeam' the 'use' role on the inventory and others the 'read' role

Question 3

During a playbook run, the task 'debug: msg={{ ansible_facts.distribution }}' outputs 'CentOS' for a host. However, the host's inventory variable 'distribution' is set to 'RedHat'. The administrator expected the inventory variable to override the fact. What is the most likely cause of this behavior?

Accepted Answer

The ansible_facts dictionary is used, which contains discovered facts that take precedence over inventory variables. In Ansible, facts discovered by the `setup` module (stored in `ansible_facts`) take precedence over inventory variables when accessed via the `ansible_facts` dictionary. The `debug` task explicitly references `ansible_facts.distribution`, which retrieves the discovered fact value ('CentOS'), not the inventory variable `distribution`. Inventory variables are stored separately and do not override facts within the `ansible_facts` namespace.

Answer

The 'gather_facts' directive is set to 'no' in the playbook

Answer

The host variable is defined in a group_var that is overridden by a host_var

Answer

The playbook uses the variable 'distribution' instead of 'ansible_facts.distribution'

Question 4

An organization uses an external secrets management system (e.g., HashiCorp Vault) to store sensitive credentials. They want to integrate it with Ansible Automation Platform so that job templates automatically retrieve credentials from Vault without storing them in the AAP database. Which approach is supported?

Accepted Answer

Create a custom credential type with an injector that uses a lookup plugin to fetch the secret from Vault. Ansible Automation Platform supports custom credential types that can use lookup plugins (such as `hashi_vault`) to retrieve secrets from external systems like HashiCorp Vault at runtime. The injector template can define environment variables or extra variables that are populated by the lookup plugin, ensuring credentials are never stored in the AAP database.

Answer

Use the built-in 'Machine' credential type and store the Vault token in the credential

Answer

Store the secret in an extra variable and reference it in the playbook

Answer

Use the 'Ansible Vault' credential type to decrypt vault-encrypted variables in the project

Question 5

Which THREE actions can an administrator perform using the inventory management features in Ansible Automation Platform? (Choose exactly three.)

Accepted Answer

Add hosts to an inventory manually. Option C is correct because the inventory management UI in Ansible Automation Platform allows an administrator to add individual hosts manually, specifying the hostname and any host variables. Option D is correct because inventories support nested/hierarchical groups, letting administrators organize hosts into parent and child groups so variables and playbook targeting cascade through the hierarchy. Option E is correct because administrators can import static inventory content from INI or YAML source files, either by pasting content or sourcing from a project, which is a core inventory management capability. Option A is not correct because job templates are launched manually, by schedule, or via workflows/API — they are not triggered automatically by an inventory sync; inventory sources themselves can be scheduled, but that is not a job template action. Option B is not correct because global-level variables that apply to all inventories are not a standard inventory management feature; variables are defined at inventory, group, or host level (or via extra vars), not as a true global inventory variable.

Answer

Create job templates that automatically execute on inventory sync

Answer

Define variables at the global level that apply to all inventories

Question 6

An Ansible Tower administrator needs to add a single host to an existing inventory. The host has a static IP address and requires SSH access with a specific username and private key. Which of the following is the correct approach?

Accepted Answer

Navigate to the inventory, click 'Add Host', enter the hostname and IP, and optionally define variables. Then create a credential for SSH and associate it with the host through a job template.. In Ansible Tower, a host is added to an inventory via the 'Add Host' form, where you enter the hostname and IP address and optionally define variables. SSH credentials are not directly associated with a host; instead, they are created separately and then linked to the host through a job template, which uses the credential to authenticate when running playbooks against that host.

Answer

Add the host to an inventory group using the 'Add Group' option and specify the host details there.

Answer

Use the 'Add Host' form and in the 'Credentials' field, select the appropriate SSH credential from the drop-down.

Answer

Create a new credential first, then add the host directly within the credential definition.

Question 7

A system administrator maintains a dynamic inventory script that queries a cloud provider API to build host lists. The script returns valid JSON, but after importing into Ansible Tower, the inventory shows zero hosts. The script is executable and placed in the expected project directory. What is the most likely cause?

Accepted Answer

The script has not been added as an inventory script in Ansible Tower's inventory scripts settings.. Ansible Tower requires that a dynamic inventory script be explicitly registered as an inventory script in the Tower UI under 'Inventories' → 'Scripts'. Even if the script is executable and returns valid JSON, Tower will not execute it unless it is configured as a custom inventory script source. The script must be added via the 'Add' button in the Inventory Scripts section, where Tower will then use it to populate the inventory.

Answer

The script does not output JSON in the correct format expected by Ansible Tower.

Answer

The script does not have the executable permission set.

Answer

The script is written in a language that Ansible Tower does not support.

Question 8

An organization has multiple Ansible Tower projects that use different cloud providers. The security team mandates that cloud API credentials stored in Tower must have restricted access and be reusable across job templates without exposing the secret key. Which credential type and organization strategy best meets these requirements?

Accepted Answer

Create separate custom credential types for each cloud provider, marking the secret key fields as 'password' type, and add them to each job template as needed.. Ansible Tower's custom credential types allow you to define fields with the 'password' type, which encrypts the secret key and hides it from view after entry. By creating separate custom credential types for each cloud provider, you can assign them to specific job templates, ensuring restricted access and reusability without exposing the secret key. This approach meets the security mandate by isolating credentials per provider and leveraging Tower's built-in encryption for sensitive fields.

Answer

Use a network credential to store the API token and assign it to the project.

Answer

Create a single custom credential type that includes both cloud provider API keys and reuse it across all projects.

Answer

Use a machine credential for each cloud provider and set the SSH key as the API secret.

Question 9

Which TWO methods can be used to limit the hosts that a job template runs against when launching a job? (Choose exactly two.)

Accepted Answer

Using the 'LIMIT' field in the job template or at launch time.. The 'LIMIT' field in Ansible Tower/AWX allows you to restrict the execution of a job template to a specific subset of hosts in the inventory, either by host name, group name, or pattern. This can be set in the job template definition or overridden at launch time, providing flexible targeting without modifying the inventory structure.

Answer

Assigning a specific credential to the job template.

Answer

Using the 'Tags' field to include only certain tasks.

Answer

Setting the 'Source Control Branch' in the project.

Question 10

Your organization uses Ansible Tower to manage a growing number of Linux servers. Currently, there is a single inventory called 'All Servers' that contains all hosts. A new project requires that certain sensitive variables (e.g., API keys) be stored securely and not exposed in job logs. The security team also wants to limit which users can use these credentials. You have been asked to implement a solution. After evaluating, you plan to create a custom credential type with a 'password' field for the API key and assign it to the job template. However, during a test run, the API key is still visible in the job output. What is the most likely reason?

Accepted Answer

The playbook contains a debug task that prints the API key variable.. Even if a credential is properly defined and assigned, any task in the playbook that explicitly references the variable (such as a debug task) will output its value in the job log. Ansible Tower's credential hiding only prevents the credential from being displayed in the job template's 'extra variables' or credential details; it does not automatically suppress the variable's value if the playbook itself prints it. The playbook author must use the 'no_log: true' directive on tasks that handle sensitive data to prevent exposure.

Answer

The custom credential type was created with an 'input' field instead of a 'password' field.

Answer

The 'no_log' parameter was not set in the Ansible configuration for the module.

Answer

The credential was not assigned to the job template; it was only assigned to the project.

Question 11

You are an Ansible Tower administrator for a company that uses a dynamic inventory script to pull hosts from AWS. The script has been working for months, but after a recent security update, the job template that uses this inventory fails with the error: 'ERROR! Unable to parse /path/to/inventory/script.py as an inventory source'. The script is executable and the path is correct. What is the most likely cause?

Accepted Answer

The required Python modules (e.g., boto3) are missing in the Tower virtual environment.. The error 'Unable to parse /path/to/inventory/script.py as an inventory source' typically occurs when the dynamic inventory script fails to execute properly. Since the script is executable and the path is correct, the most likely cause is that the required Python modules (e.g., boto3 for AWS) are missing in the Ansible Tower virtual environment. Tower runs inventory scripts in its own Python virtual environment, and if boto3 is not installed there, the script cannot import it and fails, leading to the parse error.

Answer

The inventory source type has been changed to 'Manual' instead of 'Scraped from project'.

Answer

The script has been deleted from the project directory.

Answer

The script lacks execute permissions for the Tower service user.

Question 12

Your team manages a large Ansible Tower environment with multiple organizations. Each organization has its own projects, inventories, and job templates. You need to create a set of cloud credentials (AWS access key) that can be used by any job template in any organization, but you want to restrict modification of the credential to only a few administrators. What is the best way to achieve this while maintaining flexibility?

Accepted Answer

Create a single credential in the global 'Default' organization and use Tower's RBAC to grant read access to all users and admin access to a few.. Ansible Tower's RBAC allows you to create a single credential in the global 'Default' organization and then assign read permissions to all users (allowing them to use the credential in job templates) while restricting admin (write/modify) access to a few administrators. This approach maintains flexibility by making the credential available across all organizations without duplication or manual synchronization.

Answer

Store the access key in an external secrets management vault and reference it via an encrypted file in the project.

Answer

Create a separate credential in each organization and synchronize the keys manually.

Answer

Create a custom credential type that all users create their own instance of.

Question 13

An Ansible Tower administrator notices that a job template fails intermittently with a 'Host unreachable' error for a specific group of servers. The inventory is static and the host entries have correct IPs. The credential used for SSH is a machine credential with a username and password, and it works for other hosts. Upon checking the job output, the error occurs during the 'Gathering Facts' step. The SSH service on these servers is running and reachable from the Tower node. What is the most likely cause?

Accepted Answer

The credential's SSH private key has a passphrase that is not stored in the credential.. The error occurs during the 'Gathering Facts' step, which uses SSH to connect to the managed hosts. If the SSH private key has a passphrase that is not stored in the credential, Ansible Tower cannot decrypt the key to authenticate, causing a 'Host unreachable' error even though the host is actually reachable. The credential works for other hosts only if those hosts are configured to accept password-based authentication, but the failing hosts may require key-based authentication, exposing the missing passphrase.

Answer

The credential type should be 'network' instead of 'machine' for these servers.

Answer

The inventory group has hosts defined with incorrect hostnames in the ansible_host variable.

Answer

The SSH service on these servers is bound to a different port than the default 22.

Question 14

As an Ansible Tower administrator, you are tasked with setting up a job template that interacts with multiple cloud providers. The job template uses a custom credential type that includes two fields: 'api_token' (type password) and 'region' (type text). During a test run, the job fails with an error that the 'region' variable is not defined in the playbook. The playbook references {{ region }} and {{ api_token }}. You verified that the credential is assigned to the job template and the values are populated. What is the most likely issue?

Accepted Answer

The playbook uses the variable names without the credential-specific prefix.. In Ansible Tower/AWX, when a custom credential type is used, the variables defined in the credential's injector configuration are automatically prefixed with the credential name (or a custom namespace) when injected into the job environment. If the injector does not explicitly map the fields to the exact variable names used in the playbook (e.g., `region` and `api_token`), the playbook will fail with an undefined variable error. The most likely issue is that the credential's injector configuration does not set the variables as `{{ region }}` and `{{ api_token }}` without a prefix, or the playbook is expecting the variables without the credential-specific namespace that Tower injects by default.

Answer

The credential is assigned to the project instead of the job template.

Answer

The 'api_token' field is encrypted but the 'region' field is not, causing a parsing error.

Answer

The 'region' field is defined as 'password' type, so it is hidden.

Question 15

You manage an Ansible Tower instance that has multiple inventories synced from different sources (static, dynamic cloud, and satellite). Recently, a job template that uses an inventory synced from Red Hat Satellite fails with 'No hosts matched' even though hosts exist in Satellite. The inventory sync job runs successfully and shows hosts populated in Tower. The job template uses a limit field set to '*' and there are no tags or other filters. The playbook is simple: 'hosts: all'. What is the most likely cause?

Accepted Answer

The inventory source is configured to use 'scraped from project' instead of 'satellite'.. If the inventory source is configured to use 'scraped from project' instead of 'satellite', the inventory will not contain hosts from Satellite. Although the sync runs successfully, it imports hosts from a project file, not from Satellite. Consequently, the job template's playbook with 'hosts: all' will find no hosts from Satellite, resulting in 'No hosts matched'. To resolve, configure the inventory source to 'Red Hat Satellite' with the correct credential and organization.

Answer

The inventory sync job is not scheduled to run before the job template.

Answer

The groups imported from Satellite are nested and the job template's limit does not include the parent group.

Answer

The credential used for Satellite sync is expired.