EX294 Manage inventories and credentials Practice Test 3 — 15 Questions

Question 1

An Ansible playbook uses a vault-encrypted variable `db_password` from a vars file. The playbook fails with 'Decryption failed' error. Which of the following could be the cause?

Accepted Answer

The vault ID in the encrypted file does not match the provided vault ID.. Ansible Vault supports multiple vault IDs, and the vault ID used to encrypt the variable must match the vault ID provided at runtime (via `--vault-id` or `ansible.cfg`). If the encrypted file was created with vault ID 'prod' but the playbook is run with vault ID 'dev', Ansible will fail with 'Decryption failed' because it cannot find a matching password for that ID.

Answer

The vault password is correct but the file is corrupted.

Answer

The vault password file path is incorrect in ansible.cfg.

Answer

The variable is not encrypted but marked as `!vault`.

Question 2

A team is configuring an inventory to manage Windows hosts via Ansible. Which TWO inventory variables must be defined for each host?

Accepted Answer

ansible_host. `ansible_host` defines the IP address or FQDN that Ansible uses to connect to the managed host. For Windows hosts, this is essential because Ansible cannot rely on the inventory hostname alone (which may be a short name or not resolvable). Option E is correct because `ansible_connection` must be set to `winrm` for Windows hosts; without it, Ansible defaults to SSH, which will fail against Windows targets.

Answer

ansible_shell_type

Answer

ansible_user

Answer

ansible_winrm_server_cert_validation

Question 3

An Ansible Tower administrator needs to create a custom credential type that uses an SSH private key and a username. Which THREE components should be defined in the credential type's configuration?

Accepted Answer

"fields": [{"id": "ssh_key_data", "type": "string", "label": "SSH Private Key", "multiline": true, "secret": true}]. The SSH private key must be defined as a field with `"type": "string"`, `"multiline": true` (since SSH keys are multi-line), and `"secret": true` (to encrypt the value in the database). This matches the standard Ansible Tower custom credential type schema for storing sensitive key material.

Answer

"fields": [{"id": "password", "type": "string", "label": "Password"}]

Answer

"fields": [{"id": "key_type", "type": "string", "label": "Key Type"}]

Question 4

An Ansible playbook uses the `fetch` module to retrieve files from managed hosts. Which TWO inventory variables are commonly used to construct unique destination paths for each host?

Accepted Answer

inventory_hostname. The `fetch` module retrieves files from managed hosts and stores them locally. To avoid overwriting files from different hosts, you must use unique destination paths. `inventory_hostname` provides the hostname as defined in the inventory, and `ansible_host` provides the actual IP or FQDN used to connect, both of which are commonly used to create distinct per-host directories or filenames.

Answer

dest

Answer

hostvars

Answer

group_names

Question 5

Refer to the exhibit. A playbook runs against the `web` group. What username will be used for host web2?

Accepted Answer

deploy. The playbook runs against the `web` group, and host `web2` inherits the `ansible_user` variable from the group-level inventory definition. In Ansible, the `ansible_user` variable determines the SSH username for the connection. Since the exhibit (not shown here but implied) sets `ansible_user: deploy` for the `web` group, all hosts in that group, including `web2`, will use `deploy` as the SSH username unless overridden at the host level.

Answer

undetermined

Answer

admin

Answer

root

Question 6

Refer to the exhibit. An Ansible playbook targeting server1 fails with a permissions error when connecting. The administrator notices the SSH private key is being used. Which change will likely fix the issue?

Accepted Answer

Change ansible_user to 'ec2-user'.. The error indicates that the SSH private key being used does not correspond to the user attempting to connect. In many cloud environments like AWS, the default user for Amazon Linux 2 is 'ec2-user', and the SSH private key is tied to that user. Changing `ansible_user` to 'ec2-user' ensures the correct user context for key-based authentication, resolving the permissions error.

Answer

Add `ansible_become: yes` to the playbook.

Answer

Remove ansible_ssh_common_args.

Answer

Set ansible_ssh_private_key_file to a different key.

Question 7

Refer to the exhibit. A playbook includes this vars file and runs `systemctl restart httpd`. The playbook fails because it cannot decrypt the vault. Which of the following is the most likely cause?

Accepted Answer

The vault password is not provided.. The error 'cannot decrypt the vault' indicates that Ansible is unable to decrypt the vault-encrypted variable file. This occurs when the vault password is not provided via `--ask-vault-pass`, `--vault-password-file`, or the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable. Without the correct password, Ansible cannot decrypt the vault, causing the playbook to fail.

Answer

The vault ID is missing.

Answer

The variable db_password is not used in the playbook.

Answer

The vault file is corrupted.

Question 8

A company uses a static inventory file for Ansible Tower. They need to add a new host to an existing group. Which action should they take?

Accepted Answer

Edit the inventory in the Tower UI and add the host to the group.. The company uses a static inventory file for Ansible Tower, and the Tower UI provides a built-in interface to manage static inventories. Editing the inventory in the Tower UI and adding the host to the group directly updates the underlying static inventory file and synchronizes it with Tower's database, ensuring the host is available for job runs without manual file manipulation.

Answer

Use the ansible-inventory command to add the host.

Answer

Modify the static inventory file and run a job template.

Answer

Create a new inventory and host group.

Question 9

An administrator needs to store a database password securely for use in playbooks. Which credential type should they create?

Accepted Answer

Vault credential. A Vault credential is the correct choice because Ansible Vault is specifically designed to encrypt sensitive data like passwords, API keys, and other secrets used in playbooks. It allows the administrator to store the database password in an encrypted file that can be decrypted at runtime using a vault password, ensuring the secret is not exposed in plaintext in the playbook or inventory.

Answer

Source control credential

Answer

Machine credential

Answer

Network credential

Question 10

A playbook requires a secret token that changes every hour. The token is stored in a password vault. Which setting should be used to have Tower retrieve the token at runtime?

Accepted Answer

Use a custom credential type that injects the vault lookup result.. Ansible Tower (now Red Hat Ansible Automation Platform) supports custom credential types that can define input and injector configurations. By using a custom credential type with an injector that includes a lookup plugin (e.g., `{{ lookup('hashi_vault', 'secret/data/token') }}`), Tower can retrieve the secret token from a password vault (like HashiCorp Vault) at runtime, ensuring the token is always current without hard-coding or manual updates.

Answer

Hard-code the token in the playbook.

Answer

Store the token in extra_vars on the job template.

Answer

Store the token in the project as a file.

Question 11

Ansible Tower is configured with a dynamic inventory source from VMware vCenter. The playbook needs to limit execution to hosts with a specific custom attribute. How should this be achieved?

Accepted Answer

Use a smart inventory filter.. Smart inventories in Ansible Tower allow you to apply a filter (using Jinja2-style syntax) against an existing inventory source, such as a dynamic VMware vCenter source, to limit execution to hosts matching specific criteria like a custom attribute. This approach avoids modifying the source script or creating duplicate inventory sources, preserving the dynamic nature of the inventory while enabling targeted host selection.

Answer

Modify the VMware inventory script to filter hosts.

Answer

Add the required hosts manually.

Answer

Create a new inventory source with a filter.

Question 12

A team is using Ansible Tower with multiple credentials per job template. The playbook uses the 'become' method to escalate privileges on remote hosts. The become password is different from the SSH password. Which configuration ensures the become password is used?

Accepted Answer

Provide both the SSH password and become password in the machine credential.. In Ansible Tower, when a job template uses multiple credentials, the machine credential is the primary credential for SSH authentication. To use a different become password, you must provide both the SSH password and the become password within the same machine credential. This is because the machine credential has dedicated fields for 'Password' (SSH) and 'Become Password' (privilege escalation), and Tower automatically uses the become password from that credential when the playbook invokes 'become: yes'.

Answer

Use a vault credential to store the become password.

Answer

Use two separate credentials (one for SSH, one for become) and assign both to the job template.

Answer

Store the become password in inventory variables.

Question 13

An organization uses multiple Satellite servers for inventory. They want to combine data from all satellites into one unified inventory in Ansible Tower. Which approach is best?

Accepted Answer

Create one inventory with multiple inventory sources, each pointing to a different Satellite.. Ansible Tower allows you to create a single inventory with multiple inventory sources, each configured to sync from a different Satellite server. This approach consolidates all host data into one unified inventory without custom scripting or requiring a central aggregator, leveraging Tower's native multi-source inventory capabilities.

Answer

Use a custom script to fetch and merge data from all Satellites into a single inventory source.

Answer

Create a smart inventory that includes all satellites.

Answer

Use a single Satellite server that aggregates data from all other Satellites.

Question 14

A job template uses a custom credential type that injects environment variables for a third-party API. The credential input defines a field 'api_key'. The playbook uses {{ api_key }} but it's empty. What is the most likely cause?

Accepted Answer

The injector configuration is missing or incorrect.. The most likely cause is that the injector configuration is missing or incorrect. In Ansible Tower/AWX, a custom credential type requires an injector definition (e.g., `env` or `file`) to map the credential input fields into environment variables or extra vars. Without a proper injector, the `api_key` field is never exposed to the job environment, so `{{ api_key }}` resolves to an empty string.

Answer

The field name is case-sensitive and the playbook uses a different case.

Answer

The credential was not assigned to the job template.

Answer

The playbook uses a different variable name.

Question 15

An Ansible Tower administrator notices that a job template using a dynamic inventory source from AWS EC2 is not updating when new instances are launched. The inventory source is set to update on launch. What is the most likely cause?

Accepted Answer

The AWS credential associated with the inventory source is invalid or expired.. The most likely cause of a dynamic inventory source not updating is that the associated AWS credential is invalid or expired. When the 'update on launch' option is enabled, Ansible Tower attempts to refresh the inventory from the source before each job run. If the credential (e.g., AWS access key ID and secret access key) is no longer valid, the inventory update will fail silently or with an error, and the job will use stale cached data.

Answer

The inventory source cache timeout is set too high.

Answer

The 'update on launch' option is disabled.

Answer

The inventory source is configured as a custom script.