EX294 Manage inventories and credentials — Timed 10 Questions

Question 1

An administrator needs to store a secret API token in Ansible Automation Controller so that it can be used in job templates without exposing the token in plain text. Which type of credential should be used?

10 minute time limit — choose an answer to begin.

Accepted Answer

Vault credential. A Vault credential in Ansible Automation Controller stores an encrypted password that can be used to decrypt Ansible Vault files. While originally designed for vault files, it can also be used to securely store any secret, such as an API token, by referencing it via the {{ vault_password }} variable in job templates. This ensures the token is never exposed in plain text. Machine credentials are for SSH authentication, Network credentials for network devices, and Cloud credentials for cloud provider APIs—none are suitable for storing arbitrary API tokens.

Answer

Machine credential

Answer

Network credential

Answer

Cloud credential

Question 2

Which TWO of the following are valid methods to supply a credential password in Ansible Automation Controller?

Accepted Answer

Prompt on launch (ask for credential on job run). Option A is correct because Automation Controller supports the 'Prompt on launch' setting on credentials, which makes the job template ask the user for the credential password at job run time instead of storing it, and this is a documented way to supply a password. Option E is correct because a Vault credential in Automation Controller is used to supply the vault password (or vault password file) that decrypts vault-encrypted variables/content, which is a valid method for supplying a credential password to a job. Option B is not a supported mechanism: job templates do not have a setting to inject a credential password via an environment variable; environment variables in Automation Controller are used for other purposes and would not securely supply a credential password. Option C is not valid because storing a password in a file in the project repository exposes the secret in source control and is not a supported credential-supply method. Option D is not valid because Automation Controller encrypts credential inputs and does not support storing a credential password in plain text in the credential definition.

Answer

Set the password via an environment variable in the job template

Answer

Include the password in a file in the project repository

Answer

Store the password in plain text in the credential definition

Question 3

The job template running against host db1 uses a machine credential with an SSH key. The key is correctly configured in Automation Controller. However, the job fails with the error shown. What is the most likely cause?

Accepted Answer

The SSH public key corresponding to the private key is not installed on the target host. The error indicates that Automation Controller cannot authenticate to host db1 using the SSH key. Since the key is correctly configured in the controller, the most likely cause is that the corresponding public key is not present in the target host's ~/.ssh/authorized_keys file. SSH key-based authentication requires the private key on the client (controller) and the public key installed on the target host; without the public key, the server rejects the connection attempt.

Answer

The vault password is incorrect

Answer

The SSH port is blocked by a firewall

Answer

The host's SSH host key has changed and the known_hosts file is outdated

Question 4

A company uses Ansible Automation Controller to manage a mix of Linux and Windows servers. Each server is in a separate inventory group. The Linux servers use SSH keys stored in machine credentials, and the Windows servers use username/password stored in machine credentials. Recently, a new security policy requires that all credentials must be rotated every 90 days. The automation team has 50 Linux servers and 20 Windows servers. They want to minimize manual effort and avoid exposing secrets in plain text during rotation. They currently have a Jenkins pipeline that can run scripts on the controller node. Which approach best meets the requirements?

Accepted Answer

Write a script that uses the Automation Controller API to update the credential's inputs (e.g., new SSH key or password) after rotating them on the target servers. It uses the Automation Controller API to programmatically update credential inputs (SSH keys or passwords) after rotating them on the target servers, which minimizes manual effort, avoids exposing secrets in plain text (the API call uses HTTPS and authentication tokens), and satisfies the 90-day rotation policy. The Jenkins pipeline can invoke a script that first rotates the secret on each server (e.g., via SSH or WinRM) and then calls the API's PATCH endpoint for the credential to update the stored value, ensuring the credential remains synchronized without manual UI intervention.

Answer

Use a Vault credential to store the new secrets and reference them in the job template

Answer

Store the new passwords directly in a playbook and run it manually on each server, then update the credential in the UI

Answer

Create a single machine credential with the same SSH key for all Linux servers and a single credential for all Windows servers

Question 5

A system administrator is managing Ansible Tower and wants to use an Azure Resource Manager credential to provision virtual machines. However, the credential fails authentication with the error '401 Unauthorized'. Which action should the administrator take to resolve the issue?

Accepted Answer

Verify the client secret in the credential matches the one configured in Azure Active Directory.. The 401 Unauthorized error when using an Azure Resource Manager credential in Ansible Tower indicates that the authentication token or secret used to authenticate with Microsoft Entra ID is invalid or mismatched. Option B is correct because verifying that the client secret stored in the Tower credential exactly matches the one configured in Microsoft Entra ID resolves the authentication failure, as Microsoft Entra ID uses OAuth 2.0 client credentials flow where the client secret is required for token acquisition.

Answer

Regenerate the SSH key pair and update the credential.

Answer

Add the credential as a playbook-level variable instead of a Tower credential.

Answer

Generate a new API token from Azure and paste it into the credential.

Question 6

An Ansible Tower administrator needs to allow a team of developers to run playbooks against specific inventory groups without allowing them to modify the inventory or credentials. Which approach best satisfies the requirement?

Accepted Answer

Assign the developers the 'Execute' role on the inventory and 'Use' role on the credential.. The 'Execute' role on an inventory allows a user to run playbooks against that inventory without granting permission to modify its contents. The 'Use' role on a credential permits the credential to be used in job templates but not viewed or edited. This combination precisely meets the requirement of allowing playbook execution while preventing inventory or credential modification.

Answer

Assign the developers the 'Update' role on the inventory and 'Admin' role on the credential.

Answer

Assign the developers the 'Admin' role on the inventory and 'Read' role on the credential.

Answer

Assign the developers the 'Read' role on both inventory and credential.

Question 7

An administrator wants to use a custom inventory script to dynamically generate hosts in Ansible Tower. Which of the following is a valid approach to manage credentials for accessing the script's API?

Accepted Answer

Define environment variables in the job template that references the inventory script, and use a credential type that injects those variables.. Ansible Tower (now Red Hat Ansible Automation Platform) allows custom credential types to inject environment variables into job runs. When a custom inventory script requires API authentication, you can define a credential type with injector configuration that sets environment variables (e.g., API_TOKEN, API_USER), then attach that credential to the job template. This keeps secrets out of scripts and repositories, following security best practices.

Answer

Attach the credential directly to the inventory script in the Ansible Tower UI.

Answer

Store the API token in a file within the project repository and source it in the script.

Answer

Embed the API token within the inventory script's JSON output.

Question 8

Which TWO of the following are valid methods to manage credentials in Ansible Tower?

Accepted Answer

Integrate with an external secrets management system using a credential lookup plugin.. Option A is correct because Ansible Tower (AWX/Ansible Automation Platform) supports credential lookup plugins that allow job templates to retrieve secrets dynamically from external secrets management systems such as HashiCorp Vault, CyberArk, or AWS Secrets Manager, keeping sensitive data out of Tower itself. Option D is correct because Tower allows administrators to define custom credential types that specify input fields and injectors, which can expose credential values as environment variables (or extra variables) inside job templates, enabling flexible integration with third-party tools. Option B is wrong because the Tower API never returns credential secrets in plain text; secrets are write-only and encrypted at rest. Option C is wrong because while machine credentials can use SSH keys, a passphrase-protected key is not itself a credential management method and requires additional handling. Option E is wrong because Tower encrypts credentials in its database using its SECRET_KEY; storing them in plain text is neither supported nor a valid management method.

Answer

Export credentials from the Ansible Tower API in plain-text.

Answer

Use machine credentials with an SSH key that has a passphrase.

Answer

Store credentials in plain-text in the Ansible Tower database.

Question 9

Drag and drop the steps to create and apply a simple Ansible playbook that installs httpd into the correct order.

Accepted Answer

Create the playbook file, then define hosts and tasks, then execute the playbook, then verify the httpd service.. A playbook defines hosts and tasks; tasks use modules; after execution, verification confirms success.

Answer

Define hosts and tasks, then create the playbook file, then execute the playbook, then verify the httpd service.

Answer

Create the playbook file, then execute the playbook, then verify the httpd service, then define hosts and tasks.

Answer

Execute the playbook, then create the playbook file, then define hosts and tasks, then verify the httpd service.

Question 10

An Ansible Tower/AWX administrator wants to prevent users from viewing credential passwords in plain text. Which credential type should be used for SSH passwords?

Accepted Answer

Machine credential. Machine credentials in Ansible Tower/AWX are the correct choice for SSH passwords because they are specifically designed to store SSH authentication parameters, including passwords, private keys, and key passphrases. When a machine credential is configured with an SSH password, Tower/AWX encrypts the password at rest and never exposes it in plain text to users through the web interface or API, ensuring that credential secrets remain hidden.

Answer

SSH credential

Answer

Password credential

Answer

Login credential