EX294 Multiple Select — 40 Questions

Question 1

Which TWO options are valid methods for including collections in an execution environment?

Accepted Answer

List collections under 'collections' in execution-environment.yml.. The `execution-environment.yml` file is the primary configuration file for building an Ansible execution environment, and it supports a `collections` key where you can list collections to be included. This is the standard method for specifying collections that should be installed during the build process, ensuring they are available in the final execution environment.

Answer

Use ansible-galaxy collection install command in a pre-build script.

Answer

Use a 'galaxy.yml' file in the build context.

Answer

Include collections in the base image directly.

Question 2

A senior engineer needs to debug an Ansible playbook that uses lookups. Which TWO plugins can be used to retrieve data from a file on the control node? (Select exactly two.)

Accepted Answer

file. The `file` lookup plugin reads the content of a file from the control node's filesystem and returns it as a string. This is the standard way to retrieve file data directly from the Ansible control node without transferring the file to the managed host.

Answer

ini

Answer

password

Answer

csvfile

Question 3

Which TWO statements about Ansible role defaults are true?

Accepted Answer

Defaults are loaded from the defaults/main.yml file.. Ansible role defaults are defined in the defaults/main.yml file within the role directory structure. These defaults provide the most basic variable values that can be easily overridden by any other variable source, ensuring flexibility in role usage.

Answer

Defaults are only loaded if no vars are defined.

Answer

Defaults have higher priority than variables defined in the playbook.

Answer

Defaults cannot be overridden.

Question 4

An administrator wants to ensure that Ansible facts gathered from a host are consistent across multiple playbook runs. Which two actions can help achieve this? (Choose two.)

Accepted Answer

Enable fact caching using 'ansible_cache' plugin with a persistent backend like Redis.. Enabling fact caching with a persistent backend like Redis stores gathered facts between playbook runs, ensuring consistency without re-gathering. Option E is correct because setting 'ANSIBLE_GATHERING=smart' with a configured cache_timeout allows Ansible to reuse cached facts within the timeout period, providing consistent data across runs.

Answer

Use 'gather_facts: no' and manually run 'setup' module with specific filter.

Answer

Use 'tags' to only gather facts on selective runs.

Answer

Disable fact caching and gather facts every time.

Question 5

An Ansible playbook uses the "community.general" collection to manage firewall rules. The engineer wants to use a lookup plugin to fetch the current IPv4 address of a host to include in a dynamic inventory script. Which TWO of the following options correctly describe the usage of lookup plugins in Ansible?

Accepted Answer

Lookup plugins are executed on the control node and return data to the Ansible controller.. Lookup plugins in Ansible are designed to run on the control node (the machine where Ansible is executed), not on the remote host. They fetch data from external sources (e.g., files, databases, environment variables) and return that data to the Ansible controller for use in playbooks or inventory scripts. This aligns with the requirement to fetch the current IPv4 address of a host for a dynamic inventory script, as the lookup plugin can query local or network sources without needing to execute on the target host.

Answer

Lookup plugins are always executed on the remote host.

Answer

Lookup plugins must be imported using the "lookup" keyword.

Answer

The "file" lookup plugin reads the content of a file from the remote host.

Question 6

An administrator has a playbook with tasks tagged 'install', 'configure', and 'service'. There are no untagged tasks. They want to run only the tasks tagged 'install' and 'configure', skipping 'service'. Which three commands will achieve this? (Choose three.)

Accepted Answer

ansible-playbook site.yml --tags install,configure. Options A, C, and E are correct. Option A uses a comma-separated list with `--tags` to run tasks tagged 'install' or 'configure'. Option C uses `--skip-tags service` to exclude the 'service' tag, running all other tags (install and configure). Option E uses multiple `--tags` options, which Ansible combines with OR logic, effectively running tasks matching either 'install' or 'configure'. Options B and D are incorrect: B runs only 'configure' tasks (since it skips install and service), and D runs only 'install' tasks (since it specifies only that tag and skips service).

Answer

ansible-playbook site.yml --tags configure --skip-tags install,service

Answer

ansible-playbook site.yml --tags install --skip-tags service

Question 7

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. `ansible-vault` encrypts variable files at rest using AES-256, allowing sensitive data like passwords or API keys to be stored securely in version control. When a playbook runs, the vault password must be provided (e.g., via `--ask-vault-pass` or a vault password file), and Ansible decrypts the file in memory only, never writing plaintext to disk. This ensures that sensitive values are not exposed in the playbook source code or logs.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 8

Which TWO of the following are best practices for securing automation controller secrets and credentials?

Accepted Answer

Use Ansible Vault to encrypt sensitive data like passwords and API keys. Ansible Vault provides encryption for sensitive data such as passwords and API keys, ensuring they are not stored in plaintext. This is a core security practice for automation controller secrets, as it protects credentials at rest and during transport when used with playbooks.

Answer

Store secrets in plain text in inventory files for simplicity

Answer

Disable logging to prevent exposure of sensitive data in logs

Answer

Grant all users admin access to reduce permission complexity

Question 9

An organization needs to implement security best practices for Ansible automation. Which three measures should be taken? (Choose three.)

Accepted Answer

Use ansible-vault to encrypt sensitive variables. `ansible-vault` is the built-in Ansible tool for encrypting sensitive data such as passwords, API keys, and secret variables. It uses AES-256 encryption to protect secrets at rest, ensuring they are not exposed in plain text within playbooks, inventory files, or version control systems. This is a fundamental security best practice for any Ansible automation environment.

Answer

Store all secrets in plain text in repository

Answer

Disable SSH host key checking globally

Question 10

Which THREE actions are required to successfully publish a collection to Automation Hub?

Accepted Answer

Build the collection with ansible-galaxy collection build.. `ansible-galaxy collection build` is the required command to package a collection into a distributable tarball (e.g., `namespace-collection-1.0.0.tar.gz`). This tarball is the artifact that is then uploaded to Automation Hub. Without building the collection, there is no file to publish.

Answer

Sign the collection with GPG.

Answer

Run ansible-galaxy collection test.

Question 11

Which THREE of the following are core components of Automation Platform that are installed by default in a standard setup?

Accepted Answer

Automation controller. Automation controller (formerly Ansible Tower) is the web-based UI and REST API platform that provides role-based access control, job scheduling, and inventory management for Ansible automation. It is installed by default as part of a standard Red Hat Ansible Automation Platform setup to serve as the central control plane.

Answer

Red Hat Enterprise Linux

Answer

Ansible Core

Question 12

Which TWO should be configured to enable centralized logging from multiple Automation Controller nodes to an external Elasticsearch cluster? (Choose two.)

Accepted Answer

Configure a logging aggregator in the controller's system settings to point to the Elasticsearch endpoint.. Automation Controller (formerly Ansible Tower) provides a built-in logging aggregator configuration in its system settings. By specifying the Elasticsearch endpoint there, the controller itself handles forwarding all relevant job and system logs from every node to the external Elasticsearch cluster, without requiring per-node agents.

Answer

Configure `logrotate` to ensure logs are not truncated before being sent.

Answer

Set up `rsyslog` on each node to forward application logs to Elasticsearch.

Answer

Install and configure `filebeat` on each controller node as a sidecar service.

Question 13

Which TWO of the following are required in a valid Ansible collection directory structure?

Accepted Answer

`galaxy.yml` file. The `galaxy.yml` file is mandatory in a valid Ansible collection directory structure because it serves as the metadata file that defines the collection's name, version, author, and dependencies. Without this file, the collection cannot be properly built, published, or installed via `ansible-galaxy`. It is the equivalent of a package manifest for the collection.

Answer

`tests/` directory

Answer

`docs/` directory

Answer

`roles/` directory

Question 14

Which THREE commands can verify the status of a rolling update on an OpenShift deployment?

Accepted Answer

oc describe deployment/. `oc describe deployment/` provides detailed information about the deployment, including the current rollout status, revision history, and conditions such as Progressing or Available. This allows you to verify whether a rolling update is in progress, has completed, or has stalled by examining fields like `Replicas`, `UpdatedReplicas`, and `Conditions`.

Answer

oc logs deployment/<name>

Answer

oc get pods -l <selector>

Question 15

Which TWO Ansible playbook parameters directly control the number of host failures allowed before aborting a rolling update?

Accepted Answer

max_fail_percentage. `max_fail_percentage` directly specifies the maximum percentage of hosts that can fail during a rolling update before Ansible aborts the entire batch. Option B is correct because `any_errors_fatal` causes the playbook to stop immediately if any host in the current batch fails, effectively limiting failures to zero before aborting the rolling update.

Answer

throttle

Answer

serial

Answer

ignore_errors

Question 16

Which TWO of the following statements about Ansible roles are correct?

Accepted Answer

Variables in 'defaults/main.yml' have the lowest precedence and can be overridden by inventory variables.. Variables in defaults/main.yml have the lowest precedence and can be overridden by inventory variables. Role dependencies are defined in meta/main.yml. The other options are incorrect: pre_tasks run before roles, include_role is dynamic, and the naming convention is not mandatory.

Answer

Role names must be prefixed with 'ansible-role-' when published to Ansible Galaxy.

Answer

The 'include_role' module can only be used for static imports.

Answer

A role's tasks are executed before any 'pre_tasks' defined in the playbook.

Question 17

An operations team is planning a rolling update of a production OpenShift cluster running Red Hat Enterprise Linux CoreOS nodes. Which three practices should be followed to ensure minimal downtime and proper rollback capability?

Accepted Answer

Use canary nodes to validate the update before full rollout.. Using canary nodes allows you to validate the update on a small subset of nodes before rolling it out to the entire cluster. This practice minimizes the blast radius of potential issues, ensuring that if the update causes problems, only the canary nodes are affected, and the rest of the cluster remains stable. It directly supports minimal downtime by catching failures early and provides a clear rollback point by isolating the test group.

Answer

Monitor cluster health via `oc get clusterversion` after each node update.

Answer

Place nodes in the same Availability Zone to simplify rollback.

Question 18

Which TWO statements about machine credentials in Ansible Tower are correct? (Choose two.)

Accepted Answer

Machine credentials can specify a 'become_method' for privilege escalation.. Ansible Tower machine credentials include a 'Become Method' field that allows you to specify privilege escalation methods such as 'sudo', 'su', 'pbrun', or 'pfexec'. This setting is used by Ansible to escalate privileges on the target machine after the initial SSH connection is established, enabling tasks that require higher-level permissions.

Answer

The SSH private key file automatically includes privilege escalation settings.

Answer

The username field is optional when using an SSH key.

Answer

SSH key credentials require a password field to be filled in.

Question 19

An Ansible playbook uses the 'block' and 'rescue' directives. Which two statements are true about this construct? (Choose two.)

Accepted Answer

A rescue section executes only if the block tasks fail.. The 'rescue' section in an Ansible block is specifically designed to execute only when a task within the 'block' fails. This allows you to define error recovery or rollback steps that run only on hosts where the block encountered a failure, ensuring that successful hosts are not affected by rescue logic.

Answer

Rescue tasks are executed on all hosts in the play.

Answer

Blocks cannot be nested.

Answer

A block can have multiple rescue sections.

Question 20

Which THREE considerations are important when designing a credential strategy in Ansible Automation Platform? (Choose exactly three.)

Accepted Answer

Credentials should be assigned to job templates rather than embedded in playbooks. Ansible Automation Platform (AAP) best practices dictate that credentials should be assigned to job templates, not embedded in playbooks. This decouples sensitive authentication data from automation logic, allowing credentials to be managed, rotated, and audited centrally through the AAP controller without exposing them in version-controlled playbook files.

Answer

All credentials must be stored within the AAP database for security

Answer

Playbooks should contain hardcoded credentials for simplicity