EX294 Manage inventories and credentials Practice Test 7 — 15 Questions

Question 1

A junior administrator needs to create an encrypted Ansible Vault password file for use with ansible-playbook. The vault password must be stored in a file named vault_pass.txt in the current directory. Which command should the administrator run?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

echo 'mysecretpassword' > vault_pass.txt. A vault password file is a plaintext file that contains the vault password on its first line. It is created using standard file redirection or an editor, not with ansible-vault commands. This file is then referenced with --vault-password-file during playbook runs to decrypt vault-encrypted content non-interactively.

Answer

ansible-vault create vault_pass.txt

Answer

ansible-vault encrypt --vault-password-file vault_pass.txt

Answer

ansible-vault encrypt_string --vault-password-file vault_pass.txt

Question 2

An administrator is creating a new inventory file for a small environment. The inventory must define a group `app` containing hosts `app1` and `app2`, and a group `db` containing host `db1`. The administrator wants to use the INI format. Which inventory file content correctly defines these groups?

Accepted Answer

[app]
app1
app2

[db]
db1. Ansible INI inventory files use square-bracketed group names followed by one host per line. The correct content defines the `app` group with app1 and app2 on separate lines, and the `db` group with db1. The other options use invalid syntax such as key-value pairs, non-standard keywords, or comma-separated hosts, which Ansible would not parse as intended.

Answer

app: app1, app2
db: db1

Answer

[app]
app1, app2
[db]
db1

Answer

group app
host app1
host app2
group db
host db1

Question 3

You provision a new RHEL 9 control node and create a project directory at /home/devops/ansible. While testing connectivity with `ansible all -m ping`, every host returns UNREACHABLE, yet `ssh` from the shell to those same hosts works without a password. The inventory file at /home/devops/ansible/inventory defines the group `web` with `web1 ansible_host=10.20.30.41`. Which action most directly resolves the failure?

Accepted Answer

Add `ansible_user=devops` to the inventory host entry or run the ad-hoc command with `-u devops`.. Because manual SSH succeeds but Ansible cannot connect, the difference lies in the identity Ansible uses. Ansible defaults to the local account name for remote logins, so when that name differs from the account holding the authorized key, the connection is refused and hosts are marked UNREACHABLE. Defining the correct remote user in inventory or on the command line restores key-based access without altering the transport.

Answer

Add `ansible_connection=local` to the inventory host entry.

Answer

Add `ansible_python_interpreter=/usr/bin/python3` to the inventory host entry.

Answer

Install the `sshpass` package on the control node.

Question 4

You run 'ansible-playbook -i inventory site.yml' and notice that a host defined in the inventory file is not targeted by a play with 'hosts: all'. The inventory file contains a group named 'ungrouped' with several hosts and a group named 'all_servers' with the same hosts. Which command most directly reveals whether Ansible is parsing the intended inventory source and listing that host under the expected groups?

Accepted Answer

ansible-inventory -i inventory --list. The ansible-inventory --list command is designed to parse an inventory source and emit the resulting groups, hosts, and variables as JSON. It is the definitive tool for confirming how Ansible interprets an inventory file, including group membership and host listing.

Answer

ansible-config dump --only-changed

Answer

ansible all -i inventory -m ping

Answer

ansible-doc -t inventory -l

Question 5

An administrator maintains a dynamic inventory script that outputs JSON. The script is placed at `/etc/ansible/inventory/aws_inventory.py` and is executable. The administrator runs `ansible-playbook -i /etc/ansible/inventory/aws_inventory.py site.yml` but receives an error: "Unable to parse /etc/ansible/inventory/aws_inventory.py as an inventory source". Which action is most likely to resolve the issue?

Accepted Answer

Ensure the script outputs a JSON object with a top-level key `_meta` containing `hostvars`, and that the script supports the `--list` argument.. Dynamic inventory scripts must be executable and support the --list argument, returning valid JSON with groups and hosts. The _meta key with hostvars is recommended to avoid separate --host calls. The parse error typically occurs when the script fails to output valid JSON or does not handle --list. The other options either misrepresent how Ansible detects dynamic inventories or take actions that would not fix the script's output.

Answer

Change the script's file extension to .json so Ansible recognizes it as a JSON inventory.

Answer

Make the script non-executable and pass it as a static inventory file.

Answer

Add the script path to the `inventory` setting in ansible.cfg and remove the -i option from the command.

Question 6

Your team stores two inventories: a static file at inventories/prod and a dynamic inventory plugin configuration at inventories/aws_ec2.yml. The static file defines the group `db` with `db1 ansible_host=172.16.5.10`, while the plugin also returns a host named db1 with the address 172.16.5.99. You run `ansible-inventory -i inventories/prod -i inventories/aws_ec2.yml --host db1`. Which host variable value does Ansible report for ansible_host?

Accepted Answer

172.16.5.99, because the last inventory source processed takes precedence for the same host.. Merging multiple inventories unifies hosts and groups rather than rejecting duplicates. For a host present in several sources, variables from the source processed later override those from earlier sources. Since the dynamic plugin is processed after the static file, its ansible_host value is the one that survives, so the host resolves to the plugin-provided address.

Answer

Both values are retained, and Ansible fails with a duplicate host variable error.

Answer

Neither value; Ansible reports the host as undefined because duplicate host names are skipped.

Answer

172.16.5.10, because the first inventory source listed on the command line takes precedence.

Question 7

A playbook must connect to hosts using a non-default SSH private key stored at /home/student/.ssh/prod_key and a non-default remote user 'deploy'. The inventory file should apply these settings to all hosts in the 'production' group without editing the playbook. Which inventory variable combination is correct?

Accepted Answer

[production:vars]
ansible_ssh_private_key_file=/home/student/.ssh/prod_key
ansible_user=deploy. Ansible uses connection variables prefixed with ansible_ to override SSH behavior. ansible_ssh_private_key_file specifies the key, and ansible_user sets the remote user. Placing them in a group vars section applies them to all hosts in that group, satisfying the scenario without modifying the playbook.

Answer

[production:vars]
private_key_file=/home/student/.ssh/prod_key
remote_user=deploy

Answer

[production:vars]
ssh_private_key_file=/home/student/.ssh/prod_key
user=deploy

Answer

[production:vars]
ansible_ssh_key=/home/student/.ssh/prod_key
ansible_remote_user=deploy

Question 8

You must store a database password that a playbook will use on managed nodes. Your security policy forbids clear-text secrets in the repository and requires that the secret remain usable with `ansible-playbook --vault-password-file /home/devops/.vault_pass`. Which two actions satisfy the policy? (Choose two.)

Accepted Answer

Create the secret with `ansible-vault encrypt_string --vault-password-file /home/devops/.vault_pass --name db_password` and paste the resulting block into the vars file.. Both accepted approaches produce artifacts encrypted with the same vault password that the required --vault-password-file supplies. Inline encryption with encrypt_string hides a single value inside an otherwise readable vars file, while encrypting an entire vars file protects a group of secrets referenced through vars_files. Each keeps clear-text secrets out of the repository while remaining fully usable at run time.

Answer

Reference the password with `lookup('env', 'DB_PASSWORD')` so it is read from the environment at run time.

Answer

Commit the password in a vars file and add the file path to a .gitignore entry in the repository root.

Answer

Define the password as an extra variable with `-e db_password=...` in the playbook invocation.

Question 9

A playbook must run only against hosts that belong to both the `webservers` group and the `production` group. Your inventory defines these as separate groups, and a host named web3 is a member of both. Which inventory pattern restricts the play's hosts to exactly that intersection?

Accepted Answer

hosts: webservers:&production. Ansible group patterns use colon-prefixed operators: a leading ampersand means intersection, a leading exclamation mark means exclusion, and a bare colon means union. Placing an ampersand before the second group limits the selection to hosts that are members of both groups, which matches the requirement that only hosts in webservers and production be targeted by the play.

Answer

hosts: webservers:production

Answer

hosts: webservers[production]

Answer

hosts: webservers:!production

Question 10

An administrator creates a group named `webservers` in an INI-style inventory and a group named `webservers` in a YAML inventory under the same inventory directory. Both groups define different hosts. What is the result when Ansible loads the inventory?

Accepted Answer

The two group definitions are merged, and the group contains the union of hosts from both files. Ansible merges group membership across all loaded inventory sources. When the same group name appears in an INI file and a YAML file, the group ends up containing the union of hosts from both definitions. There is no duplicate error and no format-based precedence for group membership.

Answer

Ansible raises a duplicate group error and refuses to load either inventory

Answer

Only the YAML definition is used because YAML takes precedence over INI

Answer

The group from the first parsed file wins and the second group definition is ignored

Question 11

An administrator needs to connect to a set of servers that use different SSH users: 'admin' for the 'web' group and 'deploy' for the 'db' group. The inventory file contains these groups. The administrator wants to avoid specifying the user in the playbook and wants the correct user to be used automatically for each group. Which method should be used?

Accepted Answer

Set ansible_user in the [web:vars] and [db:vars] sections of the inventory file.. Setting ansible_user in [group:vars] sections of the inventory file assigns the correct SSH user to all hosts in each group. This is a standard inventory feature that automatically applies group-specific connection variables. It requires no playbook modifications and ensures the right user is used for web and db hosts without manual per-host configuration.

Answer

Set the remote_user directive in the playbook and use a variable that changes per group.

Answer

Define ansible_user in host_vars for each host individually, using the correct user for that host's group.

Answer

Use the --user command-line option with a comma-separated list of users for each group.

Question 12

Your inventory directory `inventory/prod` contains a static hosts file plus a group_vars subdirectory with webservers.yml. A dynamic inventory plugin in the same directory returns the group `webservers` with a host-level variable `http_port` set to 8080. The static group_vars/webservers.yml sets `http_port: 80`. When a play runs against the webservers group, which value does the managed host receive for http_port?

Accepted Answer

8080, because a host-level variable from the plugin outranks a group-level variable from group_vars.. Variable precedence in Ansible is hierarchical rather than source-based: host variables outrank group variables, and more specific group levels outrank broader ones. Because the dynamic plugin attaches http_port to the individual host, that value sits above the group-level definition in group_vars. The managed host therefore receives 8080 even though the static group file specifies 80.

Answer

80, because the static inventory directory is processed after the dynamic plugin.

Answer

80, because group_vars files always override variables supplied by inventory plugins.

Answer

The play fails with a conflicting variable definition error.

Question 13

An administrator is using ansible-playbook with an inventory file that defines a group 'webservers' and a group 'dbservers'. The administrator wants to run a playbook only against hosts in 'webservers' but exclude any host that is also in 'dbservers'. Which inventory pattern should be used with the --limit option?

Accepted Answer

webservers:!dbservers. Ansible inventory patterns support set operations using colons and special characters. To select hosts in one group and exclude those in another, the pattern 'group1:!group2' is used. The exclamation mark indicates exclusion, and the colon separates the two patterns. This allows precise targeting of hosts for playbook execution.

Answer

webservers:&dbservers

Answer

webservers:dbservers

Answer

webservers,!dbservers

Question 14

An administrator needs to encrypt a sensitive variable file 'secrets.yml' using Ansible Vault so that it can be safely stored in a Git repository. The file should remain encrypted at rest but be automatically decrypted during playbook runs when the vault password is supplied. Which command correctly creates the encrypted file?

Accepted Answer

ansible-vault encrypt secrets.yml --vault-password-file vault_pass.txt. The ansible-vault encrypt command is the correct tool to encrypt an existing plaintext file. Using --vault-password-file provides the password non-interactively, enabling automation. The resulting file remains encrypted at rest and is decrypted automatically during playbook runs when the same vault password is supplied.

Answer

ansible-vault rekey secrets.yml --new-vault-password-file newpass.txt

Answer

ansible-vault create secrets.yml --encrypt-vault-id default

Answer

ansible-vault encrypt_string secrets.yml --name secrets

Question 15

An administrator is using Ansible Vault to protect sensitive variables in an inventory project. The project has a vault-encrypted file 'secrets.yml' that contains the variable 'db_password'. The playbook needs to use this variable. Which TWO statements are correct about using vault-encrypted variables in this scenario? (Choose two.)

Accepted Answer

The vault password can be provided at runtime using the --ask-vault-pass option when running ansible-playbook.. Providing the vault password interactively with --ask-vault-pass or via a vault password file with --vault-password-file are both valid methods to decrypt vault-encrypted files. The password file can be a script that outputs the password, which is useful for automation. Vault-encrypted files can be used for any variables, including inventory variables, and do not require an unencrypted reference file.

Answer

The variable db_password must be defined in a separate unencrypted file that references the encrypted one.

Answer

The vault-encrypted file must be listed in the ansible.cfg file under the [defaults] section as vault_identity_list.

Answer

Vault-encrypted variables can only be used in playbooks, not in inventory variables.