EX294 Manage inventories and credentials Practice Test 5 — 15 Questions

Question 1

An Ansible Tower administrator needs to add a single host to an existing inventory. The host has a static IP address and requires SSH access with a specific username and private key. Which of the following is the correct approach?

Accepted Answer

Navigate to the inventory, click 'Add Host', enter the hostname and IP, and optionally define variables. Then create a credential for SSH and associate it with the host through a job template.. Option D is correct because in Ansible Tower, a host is added to an inventory via the 'Add Host' form, where you enter the hostname and IP address and optionally define variables. SSH credentials are not directly associated with a host; instead, they are created separately and then linked to the host through a job template, which uses the credential to authenticate when running playbooks against that host.

Answer

Add the host to an inventory group using the 'Add Group' option and specify the host details there.

Answer

Use the 'Add Host' form and in the 'Credentials' field, select the appropriate SSH credential from the drop-down.

Answer

Create a new credential first, then add the host directly within the credential definition.

Question 2

A system administrator maintains a dynamic inventory script that queries a cloud provider API to build host lists. The script returns valid JSON, but after importing into Ansible Tower, the inventory shows zero hosts. The script is executable and placed in the expected project directory. What is the most likely cause?

Accepted Answer

The script has not been added as an inventory script in Ansible Tower's inventory scripts settings.. Option C is correct because Ansible Tower requires that a dynamic inventory script be explicitly registered as an inventory script in the Tower UI under 'Inventories' → 'Scripts'. Even if the script is executable and returns valid JSON, Tower will not execute it unless it is configured as a custom inventory script source. The script must be added via the 'Add' button in the Inventory Scripts section, where Tower will then use it to populate the inventory.

Answer

The script does not output JSON in the correct format expected by Ansible Tower.

Answer

The script does not have the executable permission set.

Answer

The script is written in a language that Ansible Tower does not support.

Question 3

An organization has multiple Ansible Tower projects that use different cloud providers. The security team mandates that cloud API credentials stored in Tower must have restricted access and be reusable across job templates without exposing the secret key. Which credential type and organization strategy best meets these requirements?

Accepted Answer

Create separate custom credential types for each cloud provider, marking the secret key fields as 'password' type, and add them to each job template as needed.. Option B is correct because Ansible Tower's custom credential types allow you to define fields with the 'password' type, which encrypts the secret key and hides it from view after entry. By creating separate custom credential types for each cloud provider, you can assign them to specific job templates, ensuring restricted access and reusability without exposing the secret key. This approach meets the security mandate by isolating credentials per provider and leveraging Tower's built-in encryption for sensitive fields.

Answer

Use a network credential to store the API token and assign it to the project.

Answer

Create a single custom credential type that includes both cloud provider API keys and reuse it across all projects.

Answer

Use a machine credential for each cloud provider and set the SSH key as the API secret.

Question 4

A team uses a single Ansible Tower inventory called 'Production' containing hosts for multiple environments (dev, stage, prod). They want to apply different variables to hosts based on environment. Which inventory structure meets this requirement with minimal administrative overhead?

Accepted Answer

Create groups within the inventory for each environment (e.g., 'dev', 'stage', 'prod') and assign variables at the group level.. Option A is correct because Ansible Tower (now Red Hat Ansible Automation Platform) supports group-based variable inheritance within a single inventory. By creating groups for each environment (dev, stage, prod) and assigning variables at the group level, you can apply environment-specific variables to all hosts in that group with minimal administrative overhead. This leverages Tower's built-in group variable mechanism without requiring per-host edits or multiple inventory objects.

Answer

Assign variables directly to each host using the 'Host Variables' field in the inventory.

Answer

Add tags to each host and use the tags to filter variables in the job template.

Answer

Create separate inventories for each environment and link them to the same project.

Question 5

Which TWO methods can be used to limit the hosts that a job template runs against when launching a job? (Choose exactly two.)

Accepted Answer

Using the 'LIMIT' field in the job template or at launch time.. Option C is correct because the 'LIMIT' field in Ansible Tower/AWX allows you to restrict the execution of a job template to a specific subset of hosts in the inventory, either by host name, group name, or pattern. This can be set in the job template definition or overridden at launch time, providing flexible targeting without modifying the inventory structure.

Answer

Assigning a specific credential to the job template.

Answer

Using the 'Tags' field to include only certain tasks.

Answer

Setting the 'Source Control Branch' in the project.

Question 6

Which THREE of the following are valid ways to define host variables in an Ansible inventory? (Choose exactly three.)

Accepted Answer

Inline in the inventory file, e.g., 'myhost ansible_host=192.168.1.1 http_port=8080'.. Option B is correct because Ansible allows inline host variable definitions directly in the inventory file using key=value pairs after the hostname. This is a standard syntax where variables like 'http_port=8080' are assigned to the host 'myhost' and become available as Ansible facts during playbook execution. The 'ansible_host' special variable is also defined this way to override the connection address.

Answer

In the 'extra_vars' field of the job template.

Answer

In a credential's 'Input Configuration' as a secret variable.

Question 7

Your organization uses Ansible Tower to manage a growing number of Linux servers. Currently, there is a single inventory called 'All Servers' that contains all hosts. A new project requires that certain sensitive variables (e.g., API keys) be stored securely and not exposed in job logs. The security team also wants to limit which users can use these credentials. You have been asked to implement a solution. After evaluating, you plan to create a custom credential type with a 'password' field for the API key and assign it to the job template. However, during a test run, the API key is still visible in the job output. What is the most likely reason?

Accepted Answer

The playbook contains a debug task that prints the API key variable.. Option B is correct because even if a credential is properly defined and assigned, any task in the playbook that explicitly references the variable (such as a debug task) will output its value in the job log. Ansible Tower's credential hiding only prevents the credential from being displayed in the job template's 'extra variables' or credential details; it does not automatically suppress the variable's value if the playbook itself prints it. The playbook author must use the 'no_log: true' directive on tasks that handle sensitive data to prevent exposure.

Answer

The custom credential type was created with an 'input' field instead of a 'password' field.

Answer

The 'no_log' parameter was not set in the Ansible configuration for the module.

Answer

The credential was not assigned to the job template; it was only assigned to the project.

Question 8

You are an Ansible Tower administrator for a company that uses a dynamic inventory script to pull hosts from AWS. The script has been working for months, but after a recent security update, the job template that uses this inventory fails with the error: 'ERROR! Unable to parse /path/to/inventory/script.py as an inventory source'. The script is executable and the path is correct. What is the most likely cause?

Accepted Answer

The required Python modules (e.g., boto3) are missing in the Tower virtual environment.. The error 'Unable to parse /path/to/inventory/script.py as an inventory source' typically occurs when the dynamic inventory script fails to execute properly. Since the script is executable and the path is correct, the most likely cause is that the required Python modules (e.g., boto3 for AWS) are missing in the Ansible Tower virtual environment. Tower runs inventory scripts in its own Python virtual environment, and if boto3 is not installed there, the script cannot import it and fails, leading to the parse error.

Answer

The inventory source type has been changed to 'Manual' instead of 'Scraped from project'.

Answer

The script has been deleted from the project directory.

Answer

The script lacks execute permissions for the Tower service user.

Question 9

Your team manages a large Ansible Tower environment with multiple organizations. Each organization has its own projects, inventories, and job templates. You need to create a set of cloud credentials (AWS access key) that can be used by any job template in any organization, but you want to restrict modification of the credential to only a few administrators. What is the best way to achieve this while maintaining flexibility?

Accepted Answer

Create a single credential in the global 'Default' organization and use Tower's RBAC to grant read access to all users and admin access to a few.. Option D is correct because Ansible Tower's RBAC allows you to create a single credential in the global 'Default' organization and then assign read permissions to all users (allowing them to use the credential in job templates) while restricting admin (write/modify) access to a few administrators. This approach maintains flexibility by making the credential available across all organizations without duplication or manual synchronization.

Answer

Store the access key in an external secrets management vault and reference it via an encrypted file in the project.

Answer

Create a separate credential in each organization and synchronize the keys manually.

Answer

Create a custom credential type that all users create their own instance of.

Question 10

An Ansible Tower administrator notices that a job template fails intermittently with a 'Host unreachable' error for a specific group of servers. The inventory is static and the host entries have correct IPs. The credential used for SSH is a machine credential with a username and password, and it works for other hosts. Upon checking the job output, the error occurs during the 'Gathering Facts' step. The SSH service on these servers is running and reachable from the Tower node. What is the most likely cause?

Accepted Answer

The credential's SSH private key has a passphrase that is not stored in the credential.. Option A is correct because the error occurs during the 'Gathering Facts' step, which uses SSH to connect to the managed hosts. If the SSH private key has a passphrase that is not stored in the credential, Ansible Tower cannot decrypt the key to authenticate, causing a 'Host unreachable' error even though the host is actually reachable. The credential works for other hosts only if those hosts are configured to accept password-based authentication, but the failing hosts may require key-based authentication, exposing the missing passphrase.

Answer

The credential type should be 'network' instead of 'machine' for these servers.

Answer

The inventory group has hosts defined with incorrect hostnames in the ansible_host variable.

Answer

The SSH service on these servers is bound to a different port than the default 22.

Question 11

As an Ansible Tower administrator, you are tasked with setting up a job template that interacts with multiple cloud providers. The job template uses a custom credential type that includes two fields: 'api_token' (type password) and 'region' (type text). During a test run, the job fails with an error that the 'region' variable is not defined in the playbook. The playbook references {{ region }} and {{ api_token }}. You verified that the credential is assigned to the job template and the values are populated. What is the most likely issue?

Accepted Answer

The playbook uses the variable names without the credential-specific prefix.. Option A is correct because in Ansible Tower/AWX, when a custom credential type is used, the variables defined in the credential's injector configuration are automatically prefixed with the credential name (or a custom namespace) when injected into the job environment. If the injector does not explicitly map the fields to the exact variable names used in the playbook (e.g., `region` and `api_token`), the playbook will fail with an undefined variable error. The most likely issue is that the credential's injector configuration does not set the variables as `{{ region }}` and `{{ api_token }}` without a prefix, or the playbook is expecting the variables without the credential-specific namespace that Tower injects by default.

Answer

The credential is assigned to the project instead of the job template.

Answer

The 'api_token' field is encrypted but the 'region' field is not, causing a parsing error.

Answer

The 'region' field is defined as 'password' type, so it is hidden.

Question 12

You manage an Ansible Tower instance that has multiple inventories synced from different sources (static, dynamic cloud, and satellite). Recently, a job template that uses an inventory synced from Red Hat Satellite fails with 'No hosts matched' even though hosts exist in Satellite. The inventory sync job runs successfully and shows hosts populated in Tower. The job template uses a limit field set to '*' and there are no tags or other filters. The playbook is simple: 'hosts: all'. What is the most likely cause?

Accepted Answer

The groups imported from Satellite are nested and the job template's limit does not include the parent group.. Option B is correct because when Satellite imports hosts into Tower, it often creates nested groups (e.g., a parent group containing child groups). If the job template's limit field is set to '*' (which expands to all hosts in the inventory), but the playbook's 'hosts: all' directive only matches hosts directly in the top-level group—not those in nested subgroups—the job will report 'No hosts matched'. This occurs because Ansible's inventory resolution for 'all' does not automatically recurse into child groups unless the inventory source properly flattens the group hierarchy or the limit explicitly includes the parent group.

Answer

The inventory sync job is not scheduled to run before the job template.

Answer

The inventory source is configured to use 'scraped from project' instead of 'satellite'.

Answer

The credential used for Satellite sync is expired.

Question 13

An administrator is configuring Ansible Tower for a multi-environment deployment. The team has separate Azure service principals for dev, test, and prod, and uses Ansible Vault to encrypt sensitive variables. Which TWO configuration practices ensure secure credential management and clear inventory separation?

Accepted Answer

Create a single inventory and assign all hosts to groups named dev, test, and prod, then apply credentials at the group level.. Option A is correct because using a single inventory with groups for each environment and assigning credentials at the group level is a best practice for organizing inventories. Option D is correct because defining separate credential types for each environment with unique Vault IDs ensures secure isolation of secrets. Option B is incorrect because using a single credential with overrides defeats the purpose of credential separation and is hard to manage. Option C is incorrect because storing vault passwords in files on the controller is less secure than using Vault IDs. Option E is incorrect because using the same vault password for all environments reduces security.

Answer

Use the same vault password and vault ID for all environments to simplify management.

Answer

Use a single credential of type 'Azure Service Principal' and manually override the secrets per job template.

Answer

Store the vault password in a file on the Tower server and reference it by path.

Question 14

What is the most likely cause of the failure?

Accepted Answer

The credential type is incorrect; it should be a Source Control credential, not Machine.. Option B is correct because the credential type must match the service; a Machine credential is used for SSH/WinRM, not for source control. Using a Source Control credential ensures proper authentication for the SCM project. Option A is incorrect because source_path can be a file or directory; the error is authentication-related. Option C is incorrect because update_cache_timeout=0 is valid (no caching). Option D is incorrect because source_project can accept either name or ID. Option E is incorrect because source 'scm' is valid for sourcing inventory from a project.

Answer

The inventory must be of type 'file' rather than 'scm'.

Answer

The source_path is incorrect because it should be a directory, not a file.

Answer

The source_project should reference the project ID, not name.

Answer

The update_cache_timeout should be a positive integer.

Question 15

An administrator is managing an Ansible Automation Platform deployment that runs job templates against a dynamic inventory sourced from VMware vCenter. The administrator updated the vCenter credentials in Tower after a password rotation. However, subsequent inventory syncs continue to fail with authentication errors. The administrator has confirmed that the new credentials work when tested directly on the controller node using the 'govc' CLI tool. The inventory source is configured to use the updated credential and the update_on_launch flag is set to true. Which action should the administrator take to resolve the issue?

Accepted Answer

Run the inventory sync with the 'Clear Cache' option enabled.. Option A is correct because clearing the cache forces a fresh inventory sync that discards any cached credentials or data, ensuring the new credentials are used. Option B is incorrect because restarting services is a brute-force approach that may clear cache but is not the targeted solution. Option C is incorrect because recreating the credential is unnecessary; the existing credential is valid. Option D is incorrect because changing the inventory source name and reconfiguring it is overkill and does not directly address the caching issue.

Answer

Recreate the credential and assign it to the inventory source again.

Answer

Restart the ansible-tower service.

Answer

Change the inventory source to use a new name and reconfigure it.