EX294 Manage inventories and credentials Practice Test 4 — 15 Questions

Question 1

An administrator is configuring Ansible Tower for a multi-environment deployment. The team has separate Azure service principals for dev, test, and prod, and uses Ansible Vault to encrypt sensitive variables. Which TWO configuration practices ensure secure credential management and clear inventory separation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a single inventory and assign all hosts to groups named dev, test, and prod, then apply credentials at the group level.. Grouping hosts by environment within a single inventory and assigning Azure Service Principal credentials at the group level allows clear separation of environments while keeping inventory management centralized. This approach leverages Tower's native group-level credential assignment to ensure each environment uses its own service principal without manual overrides. Option D is also correct because defining separate credential types with unique Vault IDs ensures each environment's encrypted variables are decrypted only with the corresponding vault password, preventing cross-environment access to secrets.

Answer

Use the same vault password and vault ID for all environments to simplify management.

Answer

Use a single credential of type 'Azure Service Principal' and manually override the secrets per job template.

Answer

Store the vault password in a file on the Tower server and reference it by path.

Question 2

What is the most likely cause of the failure?

Accepted Answer

The credential type is incorrect; it should be a Source Control credential, not Machine.. In Ansible Automation Platform (AAP) / Tower, an SCM-type inventory source requires a Source Control credential (e.g., a GitHub or GitLab credential) to authenticate to the repository. A Machine credential is used for SSH/WinRM connections to managed hosts, not for cloning repositories, so the inventory sync fails. The credential type must match the source type.

Answer

The inventory must be of type 'file' rather than 'scm'.

Answer

The source_path is incorrect because it should be a directory, not a file.

Answer

The source_project should reference the project ID, not name.

Answer

The update_cache_timeout should be a positive integer.

Question 3

An administrator is managing an Ansible Automation Platform deployment that runs job templates against a dynamic inventory sourced from VMware vCenter. The administrator updated the vCenter credentials in Tower after a password rotation. However, subsequent inventory syncs continue to fail with authentication errors. The administrator has confirmed that the new credentials work when tested directly on the controller node using the 'govc' CLI tool. The inventory source is configured to use the updated credential and the update_on_launch flag is set to true. Which action should the administrator take to resolve the issue?

Accepted Answer

Run the inventory sync with the 'Clear Cache' option enabled.. The inventory sync might be using cached credentials or data, and clearing the cache forces a fresh sync that uses the updated credentials. Option A is incorrect because recreating the credential is unnecessary; the existing credential is valid and works when tested. Option B is incorrect because restarting the ansible-tower service is not a targeted solution and may not clear the inventory cache. Option D is incorrect because changing the inventory source name and reconfiguring it is overkill and does not directly address the caching issue.

Answer

Recreate the credential and assign it to the inventory source again.

Answer

Restart the ansible-tower service.

Answer

Change the inventory source to use a new name and reconfigure it.

Question 4

An administrator maintains a flat inventory file at /home/user/inventory with two groups: 'web' and 'db'. The database team wants a separate inventory file for their hosts, but the web team insists on keeping their hosts in the original file. Both inventories must be used together in a single playbook run without modifying the existing files. Which approach should the administrator use?

Accepted Answer

Create a directory named 'inventory' and place both inventory files inside it, then pass the directory path to ansible-playbook.. Ansible treats a directory passed to -i as an inventory source and processes all files within it, merging hosts and groups. This keeps the original flat file untouched while adding the database team's file, and both sets of hosts are available in one playbook run. Passing multiple -i flags or using an environment variable list does not merge inventories.

Answer

Use the 'ansible-inventory --merge' command to combine both files into a new file before running the playbook.

Answer

Pass both files with multiple -i flags: ansible-playbook -i /home/user/inventory -i /path/to/db_inventory playbook.yml.

Answer

Set the ANSIBLE_INVENTORY environment variable to a colon-separated list of both file paths before running the playbook.

Question 5

An administrator is using Ansible Automation Platform with an inventory sourced from a cloud provider. The inventory plugin requires authentication credentials to query the cloud API. The administrator wants to store these credentials securely and reference them in the inventory configuration file. Which method should be used to provide the credentials to the inventory plugin?

Accepted Answer

Store the credentials in an encrypted file using ansible-vault and reference the file in the inventory plugin configuration.. The secure and supported method is to store credentials in an ansible-vault encrypted file and reference that file in the inventory plugin configuration. This allows the plugin to read the decrypted content at runtime when the vault password is provided, keeping credentials protected.

Answer

Use the ansible-vault command to encrypt the entire inventory plugin configuration file.

Answer

Hardcode the credentials directly in the inventory plugin configuration file.

Answer

Set the credentials as environment variables on the control node and reference them in the inventory plugin configuration.

Question 6

An administrator is configuring an Ansible inventory for a large environment. The inventory includes a group called 'database' with multiple hosts. The administrator wants to set a variable 'db_port' for all hosts in the 'database' group, but also wants to allow individual hosts to override this value if needed. Which TWO methods can be used to define the 'db_port' variable for the 'database' group? (Choose two.)

Accepted Answer

Define the variable in the [database:vars] section of the inventory file.. Group variables for the 'database' group can be defined either in the [database:vars] section of an INI inventory or in a group_vars/database.yml file. Both methods apply the variable to all hosts in the group and allow host-specific overrides, providing flexibility.

Answer

Use the ansible-inventory command with the --set option to define the variable.

Answer

Create a file named host_vars/database.yml in the same directory as the inventory file.

Answer

Define the variable in the [all:vars] section of the inventory file.

Question 7

An administrator needs to store SSH passwords for several hosts in an inventory so that Ansible can connect without prompting. The passwords must not be stored in plain text in the inventory file. Which two approaches satisfy this requirement? (Choose two.)

Accepted Answer

Use the `ansible_password` variable with the value defined in a `host_vars` file encrypted by Ansible Vault. Encrypting secret values with Ansible Vault and loading them through `group_vars` or `host_vars` keeps passwords out of plain-text inventory files while making them available to the SSH connection plugin. Placing `ansible_password` in a vault-encrypted `host_vars` file is the direct per-host solution, and a vaulted group variable achieves the same for a group.

Answer

Use the `ansible_become_pass` variable in a vault-encrypted file to authenticate the SSH connection

Answer

Define `ansible_ssh_pass` in the inventory as a plain string and rely on file permissions

Answer

Store the password in an environment variable on the control node and reference it with `lookup('env', 'SSH_PASSWORD')` in the inventory

Question 8

An automation team uses Ansible Automation Platform 2.4 and manages inventory with a dynamic inventory plugin for Amazon EC2. The plugin configuration file aws_ec2.yml is stored in the project repository and includes filters based on tags. During a recent run, the inventory failed to refresh, and the job template reported that no hosts were matched. The team wants to ensure the dynamic inventory is correctly sourced and refreshed. Which TWO actions should be taken to troubleshoot and resolve the issue? (Choose two.)

Accepted Answer

Confirm that the AWS credentials used by the inventory plugin have permissions to describe EC2 instances and that the region specified in the configuration matches where the instances reside.. The aws_ec2 dynamic inventory plugin requires a correctly placed and formatted configuration file with the plugin enabled, and valid AWS credentials with appropriate permissions in the correct region. These two factors are the most common causes of an empty inventory. Caching, project syncing, and local testing are either irrelevant or diagnostic rather than corrective in this context.

Answer

Ensure that the inventory source is defined as a 'Sourced from a Project' in the job template and that the project has been synced after any changes to the aws_ec2.yml file.

Answer

Run the command 'ansible-inventory -i aws_ec2.yml --list' locally to verify that the plugin returns hosts and that the output matches the expected groups.

Answer

Add the 'cache: True' option to the aws_ec2.yml configuration to force the plugin to use cached results instead of querying AWS.

Question 9

You are managing a static inventory file that contains both INI and YAML-style hosts. Ansible must be able to read the inventory from a directory that contains multiple inventory files, including one file with a .ini extension and one with a .yaml extension. Which TWO statements about Ansible inventory directories are correct? (Choose two.)

Accepted Answer

When -i points to a directory, Ansible processes all files in that directory, including files with extensions such as .ini, .yaml, and .json.. Ansible supports inventory directories, merging all contained files into one inventory. Files are parsed based on their extension and enabled plugins, and hosts and groups from different files are combined. This enables modular inventory design, but variable precedence when the same host appears in multiple files follows parse order.

Answer

Files in an inventory directory are parsed in alphabetical order, and if the same host appears in multiple files, the first occurrence determines its variables.

Answer

Only the first inventory file in the directory is read; subsequent files are ignored unless explicitly listed with additional -i options.

Answer

Ansible ignores files without an extension when reading an inventory directory, so a file named 'production' with INI content will not be parsed.

Question 10

A team uses Ansible Automation Controller with multiple organizations. Each organization has its own set of machines that require different SSH keys. The administrator wants to ensure that users from one organization cannot use credentials from another organization. What is the best way to achieve this isolation?

Accepted Answer

Create credentials within each organization and assign organization-level access. In Ansible Automation Controller, credentials are scoped to organizations. By creating credentials within each organization and assigning organization-level access, the administrator ensures that credentials are only visible and usable by members of that organization. This leverages the built-in role-based access control (RBAC) that isolates resources by organization, preventing cross-organization credential access.

Answer

Store credentials in separate projects and restrict project access

Answer

Set 'Use' permission on credentials only for specific users

Answer

Place users in different teams and restrict credential access by team

Question 11

An Ansible playbook uses the `ansible_password` variable to connect to a Windows host. The value is stored in an encrypted Ansible Vault file. Which credential type in Automation Controller would allow the vault password to be supplied at runtime?

Accepted Answer

Vault credential. Automation Controller's Vault credential type is specifically designed to provide the vault password needed to decrypt Ansible Vault-encrypted variables like `ansible_password`. When a job runs, the controller uses this credential to unlock the vault file, allowing the playbook to access the encrypted value at runtime without exposing the plaintext password.

Answer

Cloud credential

Answer

Machine credential

Answer

Network credential

Question 12

An administrator wants to create a custom credential type to store a third-party API key. The API key must be passed to the playbook as an environment variable `MY_API_KEY`. What is the correct Injector configuration in the custom credential type definition?

Accepted Answer

env: {MY_API_KEY: "{{ api_key }}"}. The Injector configuration for a custom credential type in Ansible Automation Platform uses the `env` key to map credential inputs to environment variables. The syntax `env: {"MY_API_KEY": "{{ api_key }}"}` correctly references the input field `api_key` using Jinja2 templating and assigns it to the environment variable `MY_API_KEY`, which the playbook can then access via `ansible_env.MY_API_KEY`.

Answer

file: {MY_API_KEY: "{{ api_key }}"}

Answer

env: {"MY_API_KEY": api_key}

Answer

extra_vars: {MY_API_KEY: "{{ api_key }}"}

Question 13

A junior admin is troubleshooting why a job template fails with 'Permission denied' when connecting to a target host. The job template uses a machine credential that appears correct. What is the first thing to check?

Accepted Answer

Check the credential's username and private key / password. The error 'Permission denied' during SSH connection to a target host indicates an authentication failure. Since the machine credential appears correct, the most immediate cause is that the username or private key/password stored in the credential is incorrect or mismatched. This is the first thing to check because the credential directly controls authentication to the target host.

Answer

Verify the inventory contains the correct host IP

Answer

Check the vault credential used in the job template

Answer

Check the project sync status

Question 14

Which THREE of the following are best practices for managing credentials in Ansible Automation Controller?

Accepted Answer

Restrict credential 'Use' permissions to specific users or teams. Ansible Automation Controller's Role-Based Access Control (RBAC) allows administrators to assign granular 'Use' permissions to specific users or teams, ensuring that only authorized entities can leverage a credential for job runs. This prevents unauthorized access to sensitive secrets and aligns with the principle of least privilege, which is a core security best practice in automation environments.

Answer

Avoid using external secret management systems; keep all secrets in Automation Controller

Answer

Share the same credential across multiple organizations for simplicity

Question 15

The inventory above is used in a job template in Automation Controller. The job template also has a machine credential assigned that specifies username 'root' and an SSH key. When the job runs against host web1, which username will Ansible use to connect?

Accepted Answer

admin (from inventory host variable). Ansible uses a specific precedence order for determining the connection user. When a host variable (like `ansible_user: admin`) is defined in the inventory for host web1, it overrides the username set in the job template's machine credential. The credential's username ('root') acts only as a fallback if no `ansible_user` is defined at the host or group level.

Answer

The username set in the job template's 'extra variables'

Answer

The first defined username in the credential chain

Answer

root (from credential)