EX294 Manage inventories and credentials Practice Test 4 — 15 Questions

Question 1

Which TWO actions are valid for managing inventory group membership in Ansible Tower?

Accepted Answer

Assigning a host to multiple groups.. Ansible Tower allows a host to be a member of multiple groups simultaneously, enabling flexible inventory organization and variable inheritance. Option E is correct because host variables override group variables when the same key is defined at both levels, following Ansible's variable precedence rules.

Answer

Using a range expression in the inventory host file.

Answer

Deleting a group deletes all hosts in it.

Answer

Creating a group as a child of itself.

Question 2

Which THREE are valid credential types in Ansible Tower?

Accepted Answer

Network credential. All five options—Network, Machine, Source control, Cloud, and Vault—are valid credential types in Ansible Tower. The question asks for three, but since all are valid, any combination of three would be correct. However, to match the expected answer set, all options are considered correct.

Question 3

Which THREE considerations are important when using dynamic inventories in Ansible Tower?

Accepted Answer

Dynamic inventory groups can be nested under static groups.. Ansible Tower allows dynamic inventory groups to be nested under static groups, enabling a hybrid inventory structure where cloud-sourced hosts can be organized within manually defined static groups for more flexible automation targeting. This is supported by the Tower inventory model, which merges static and dynamic sources into a unified group hierarchy.

Answer

Each inventory source can be assigned to multiple inventories.

Answer

Custom inventory scripts must be placed in the Tower home directory.

Question 4

An Ansible Tower administrator wants to allow a team to run playbooks against a set of production web servers without giving them direct SSH access to the hosts. Which inventory configuration approach should be used?

Accepted Answer

Create a smart inventory and use the 'prod_web' tag to filter hosts. Smart inventories in Ansible Tower allow you to define a dynamic set of hosts based on a filter, such as a tag (e.g., 'prod_web'). This enables the team to run playbooks against production web servers without granting them direct SSH access to the hosts, as Tower manages the SSH connections centrally using its own credentials.

Answer

Use the ad hoc inventory feature to specify hosts at launch time

Answer

Define a group variable for production web servers in the inventory

Answer

Create a static inventory and add each web server manually

Question 5

A sysadmin receives an error when running a job template: 'ERROR! the role 'common' was not found in the specified roles path'. The role exists in a source control repository referenced in the project. What is the most likely cause?

Accepted Answer

The project's source control sync failed, so the roles directory is empty. The error indicates that Ansible cannot find the 'common' role in the specified roles path. Since the role exists in the source control repository referenced by the project, the most likely cause is that the project's source control sync failed, leaving the roles directory empty or incomplete. Without a successful sync, the role files are not present on the Ansible control node, causing the job template execution to fail.

Answer

The inventory does not include the target hosts

Answer

The job template is configured with an incorrect schedule

Answer

The credential used does not have access to the source control repository

Question 6

An organization uses multiple Ansible Automation Platform clusters in different geographies. Each cluster has its own set of credentials for different environments. An administrator needs to ensure that job templates launched in the EMEA cluster can only use EMEA-specific credentials, while the APAC cluster uses APAC-specific credentials, without duplicating job template definitions. What is the best approach?

Accepted Answer

Configure separate organizations for each cluster and assign credentials to each organization, then use the same job template within each organization. Ansible Automation Platform organizations provide a logical boundary for credentials, projects, and job templates. By creating separate organizations for the EMEA and APAC clusters, the administrator can assign EMEA-specific credentials to the EMEA organization and APAC-specific credentials to the APAC organization. The same job template can then be created within each organization, inheriting only the credentials assigned to that organization, thus avoiding duplication of the job template definition while enforcing credential isolation.

Answer

Create separate job templates for each cluster and assign the appropriate credentials

Answer

Use the same job template and rely on host tags in the inventory to filter which credentials are used

Answer

Use an external secrets management system and call it via lookup plugin in the playbook

Question 7

A junior admin created a custom credential type for a third-party API. When running a job that uses this credential, the job fails with 'type object 'Credentials' has no attribute' error. What is the most likely issue?

Accepted Answer

The 'inputs' section in the credential type definition has a misconfigured field name. The error 'type object 'Credentials' has no attribute' typically occurs when the credential type definition's 'inputs' section references a field name that does not match the actual attribute expected by the credential plugin or injector. In Ansible Tower/AWX, the 'inputs' section defines the fields a user fills in (e.g., username, password), and if a field name is misspelled or mismatched with what the credential plugin expects, the plugin cannot find the attribute, causing this error. Option A is correct because a misconfigured field name in 'inputs' directly leads to this attribute lookup failure.

Answer

The 'injectors' section in the credential type definition is missing

Answer

The credential is not assigned to the job template

Answer

The job template is missing the required extra variables

Question 8

An administrator needs to restrict access to an inventory so that only members of the 'WebTeam' can update its host variables and group memberships. Other users should be able to view the inventory but not modify it. Which role-based access control (RBAC) configuration should be applied?

Accepted Answer

Assign the 'WebTeam' the 'admin' role on the inventory and others the 'read' role. In Ansible Tower/AWX, the 'admin' role on an inventory grants full update permissions (including host variables and group memberships), while the 'read' role provides view-only access. This directly satisfies the requirement that only WebTeam members can modify the inventory, and others can only view it.

Answer

Create a job template and assign 'WebTeam' the 'execute' role

Answer

Make the 'WebTeam' organization administrators and assign others the 'read' role on the organization

Answer

Assign the 'WebTeam' the 'use' role on the inventory and others the 'read' role

Question 9

During a playbook run, the task 'debug: msg={{ ansible_facts.distribution }}' outputs 'CentOS' for a host. However, the host's inventory variable 'distribution' is set to 'RedHat'. The administrator expected the inventory variable to override the fact. What is the most likely cause of this behavior?

Accepted Answer

The ansible_facts dictionary is used, which contains discovered facts that take precedence over inventory variables. In Ansible, facts discovered by the `setup` module (stored in `ansible_facts`) take precedence over inventory variables when accessed via the `ansible_facts` dictionary. The `debug` task explicitly references `ansible_facts.distribution`, which retrieves the discovered fact value ('CentOS'), not the inventory variable `distribution`. Inventory variables are stored separately and do not override facts within the `ansible_facts` namespace.

Answer

The 'gather_facts' directive is set to 'no' in the playbook

Answer

The host variable is defined in a group_var that is overridden by a host_var

Answer

The playbook uses the variable 'distribution' instead of 'ansible_facts.distribution'

Question 10

An administrator needs to provide a set of credentials to a job template that requires a machine credential for SSH and a source control credential for the project. What is the correct way to associate these credentials?

Accepted Answer

Assign both a machine credential and a source control credential to the job template. Ansible Tower/AWX allows multiple credentials of different types to be assigned to a single job template. A machine credential handles SSH authentication for target hosts, while a source control credential manages authentication for the project repository (e.g., Git). This separation follows Ansible's modular credential design, where each credential type serves a distinct purpose and can be independently managed.

Answer

Define the source control token in the playbook using the 'set_fact' module

Answer

Create a single credential that includes both SSH key and source control token

Answer

Store the source control token as an extra variable in the job template

Question 11

An inventory is sourced from an external dynamic inventory plugin. The plugin returns hosts with groups including 'webservers' and 'dbservers'. An administrator wants to add a custom variable to all hosts in the 'webservers' group without modifying the plugin script. How can this be achieved?

Accepted Answer

Create a group_vars file named 'webservers' in the project directory and define the variable. Ansible's group_vars mechanism allows you to define variables for all hosts in a group by creating a YAML file named after the group (e.g., 'webservers') in the group_vars directory. This approach does not require modifying the dynamic inventory plugin script, which is external and should remain untouched. The variable will be automatically applied to all hosts in the 'webservers' group during playbook execution.

Answer

Modify the dynamic inventory plugin script to add the variable

Answer

Add the variable to the host_vars file for each host

Answer

Use the 'add_host' module in a playbook to set the variable

Question 12

An organization uses an external secrets management system (e.g., HashiCorp Vault) to store sensitive credentials. They want to integrate it with Ansible Automation Platform so that job templates automatically retrieve credentials from Vault without storing them in the AAP database. Which approach is supported?

Accepted Answer

Create a custom credential type with an injector that uses a lookup plugin to fetch the secret from Vault. Ansible Automation Platform supports custom credential types that can use lookup plugins (such as `hashi_vault`) to retrieve secrets from external systems like HashiCorp Vault at runtime. The injector template can define environment variables or extra variables that are populated by the lookup plugin, ensuring credentials are never stored in the AAP database.

Answer

Use the built-in 'Machine' credential type and store the Vault token in the credential

Answer

Store the secret in an extra variable and reference it in the playbook

Answer

Use the 'Ansible Vault' credential type to decrypt vault-encrypted variables in the project

Question 13

Which TWO statements about inventory groups in Ansible Automation Platform are correct? (Choose exactly two.)

Accepted Answer

A host can belong to multiple groups. Ansible's inventory system allows a host to belong to multiple groups simultaneously. This is a fundamental feature of Ansible's inventory model, enabling flexible host organization and variable inheritance from all parent groups.

Answer

Host variables are the only way to define variables for a host

Answer

Groups cannot be members of other groups

Answer

Dynamic inventory sources cannot produce groups

Question 14

Which THREE considerations are important when designing a credential strategy in Ansible Automation Platform? (Choose exactly three.)

Accepted Answer

Credentials should be assigned to job templates rather than embedded in playbooks. Ansible Automation Platform (AAP) best practices dictate that credentials should be assigned to job templates, not embedded in playbooks. This decouples sensitive authentication data from automation logic, allowing credentials to be managed, rotated, and audited centrally through the AAP controller without exposing them in version-controlled playbook files.

Answer

All credentials must be stored within the AAP database for security

Answer

Playbooks should contain hardcoded credentials for simplicity

Question 15

Which THREE actions can an administrator perform using the inventory management features in Ansible Automation Platform? (Choose exactly three.)

Accepted Answer

Add hosts to an inventory manually. Ansible Automation Platform allows administrators to manually add hosts to an inventory through the web UI or API, enabling direct management of target nodes without relying on external sources. This is a fundamental inventory management feature for defining the hosts that playbooks will target.

Answer

Create job templates that automatically execute on inventory sync

Answer

Define variables at the global level that apply to all inventories