EX294 Coordinate rolling updates — 25 Questions

Question 1

A company uses Ansible to manage rolling updates of a web server fleet. During a deployment, the playbook fails on one host due to a transient network error, and the rest of the fleet is left in an inconsistent state. Which strategy would best minimize the risk of inconsistency in future rolling updates?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set max_fail_percentage to 0 in the serial block to abort the rollout on any failure.. Setting `max_fail_percentage: 0` in a rolling update (using `serial`) tells Ansible to abort the entire playbook run if any single host fails. This prevents the rest of the fleet from being updated, avoiding an inconsistent state where some hosts have the new deployment and others do not. It directly addresses the risk of partial rollouts caused by transient errors.

Answer

Add retries to each task so transient errors are automatically retried.

Answer

Use a larger serial batch size to complete the rollout faster.

Answer

Set ignore_errors: yes on all tasks to continue despite failures.

Question 2

An operations team is designing a rolling update for a stateful application that requires quorum (minimum 3 out of 5 nodes online). They plan to use Ansible's serial keyword. Which serial value ensures the update proceeds without breaking quorum while still being efficient?

Accepted Answer

serial: 2. Setting serial: 2 ensures that only 2 nodes are taken down at a time during the rolling update. With a quorum requirement of 3 out of 5 nodes, taking down 2 nodes leaves 3 online, maintaining quorum. This is the most efficient value that does not risk breaking quorum.

Answer

serial: 1

Answer

serial: 3

Answer

serial: 5

Question 3

Which TWO options are best practices for coordinating rolling updates with Ansible? (Choose exactly two.)

Accepted Answer

Use the serial keyword to update hosts in batches.. The `serial` keyword in Ansible controls how many hosts are updated at a time during a rolling update, allowing you to update hosts in batches to maintain service availability. This is a best practice for coordinating rolling updates as it prevents overwhelming the infrastructure and ensures that a subset of hosts remains operational while others are being updated.

Answer

Set ignore_errors: yes to ensure the playbook continues even if some hosts fail.

Answer

Use the default serial setting (all hosts) for simplicity.

Answer

Run all hosts in parallel to minimize total update time.

Question 4

Refer to the exhibit. The playbook uses serial: 1 (one host at a time). The update failed on web3.example.com. Based on the output, what is the most likely reason the play did not abort the rollout and how should the playbook be modified to stop on failure?

Accepted Answer

Add max_fail_percentage: 0 to the play to abort on any failure.. The play uses `serial: 1` to update one host at a time, but by default Ansible continues to the next host even if a task fails on the current host. Setting `max_fail_percentage: 0` at the play level tells Ansible to abort the entire play immediately if any host fails, which is the intended behavior for a rolling update where a single failure should stop the rollout.

Answer

Add retries: 3 to the 'Update Apache config' task.

Answer

Set ignore_errors: yes on the 'Update Apache config' task.

Answer

Increase the serial value to update multiple hosts at once.

Question 5

You are managing a rolling update of a 10-node web application cluster using Ansible. The application requires that at least 8 nodes remain available during the update to handle traffic. You have written a playbook that uses serial: 2 (updates 2 nodes at a time). During a test run, the playbook updates the first batch of 2 nodes successfully, but when it proceeds to the second batch, one of the nodes fails to restart the web service. However, the playbook continues and updates the remaining nodes. At the end, only 7 nodes are healthy, causing performance degradation. You need to ensure that if a batch fails to meet the minimum health requirements, the entire rollout is stopped and no further updates are applied. Which course of action should you take?

Accepted Answer

Use a rolling update strategy with serial: 2 and a post-task health check, and set max_fail_percentage to abort the play if the healthy node count drops below 8.. This approach uses `max_fail_percentage` at the play level to abort the playbook if a certain percentage of tasks fail. Combined with a post-task health check that fails when fewer than 8 nodes are healthy, the playbook stops if the healthy node count drops below the required threshold, preventing further updates and performance degradation. The `serial: 2` ensures nodes are updated in batches, and the health check verifies the minimum healthy count after each batch.

Answer

Add a retry loop to the service restart task with a delay and count of 5.

Answer

Set ignore_errors: yes on the service restart task to avoid failures stopping the playbook.

Answer

Increase serial to 3 to complete the update faster and reduce the chance of node failures.

Question 6

An Ansible Engineer is planning a rolling update for a web application deployed across 10 nodes. The playbook uses the 'delegate_to' directive to manage load balancer health checks. Which of the following best describes the recommended approach to minimize downtime?

Accepted Answer

Use 'serial: 1' and delegate load balancer disable/enable tasks to localhost, ensuring each node is taken out of rotation before updating.. Using 'serial: 1' ensures that only one node is updated at a time, and delegating load balancer disable/enable tasks to localhost (or the Ansible control node) allows the playbook to interact with the load balancer API to remove the node from the pool before the update and re-add it after. This minimizes downtime by ensuring traffic is not sent to a node being updated, while other nodes continue serving requests.

Answer

Run the update playbook with 'serial: 10' to update all nodes at once, then run a separate playbook to update the load balancer.

Answer

Run the update on each node manually using 'ansible-playbook --limit' and skip load balancer management to save time.

Answer

Use 'strategy: free' to allow nodes to update independently without controlling the load balancer.

Question 7

Which TWO of the following are best practices when coordinating rolling updates with Ansible?

Accepted Answer

Define a 'max_fail_percentage' to abort the update if too many hosts fail.. 'max_fail_percentage' allows you to define a threshold of host failures (as a percentage of the batch size) that, when exceeded, causes Ansible to abort the entire rolling update. This prevents the update from continuing when too many hosts have failed, which could lead to an inconsistent or degraded state across the infrastructure. Option B is correct because the 'serial' keyword controls the number of hosts (or percentage) that Ansible updates in each batch, ensuring that only a subset of hosts is taken out of service at a time, which maintains overall service availability during the rolling update.

Answer

Use 'strategy: free' to allow hosts to run tasks independently.

Answer

Use 'gather_facts: no' to speed up the playbook.

Answer

Set 'any_errors_fatal: true' to stop the update on the first failure.

Question 8

A team runs the playbook shown in the exhibit. They notice that during the update, some requests are still being sent to servers that have been disabled. What is the most likely cause?

Accepted Answer

The 'serial: 2' setting allows two hosts to be disabled simultaneously, and the load balancer may not have drained connections.. The `serial: 2` setting causes Ansible to update two hosts at a time. When a host is disabled in the load balancer, existing connections may not be fully drained before the next batch of hosts is updated, allowing traffic to still reach disabled servers. The load balancer needs time to drain active sessions, and a serial batch of 2 can overlap with that drain window.

Answer

The disable task should use 'state: maintenance' instead of 'state: disabled'.

Answer

The 'delegate_to' should be set to localhost, not lb01.

Answer

The 'serial' keyword is incorrectly used as a global variable.

Question 9

An administrator needs to update a web application that runs as a Kubernetes Deployment with 5 replicas. The application is stateless, but the update must not cause any downtime. Which TWO strategies ensure zero-downtime rolling updates?

Accepted Answer

Set strategy type to RollingUpdate with maxUnavailable=0 and maxSurge=1.. Setting `maxUnavailable=0` ensures that no pods are taken down before new ones are ready, while `maxSurge=1` allows one extra pod to be created above the desired replica count, enabling a rolling update without any downtime. This combination guarantees that at least 5 pods are always available during the update process.

Answer

Omit the liveness probe from the pod spec.

Answer

Set maxUnavailable=1 and maxSurge=0.

Answer

Use the Recreate strategy.

Question 10

You are managing a Kubernetes cluster running a critical stateful application deployed as a StatefulSet with 3 replicas. The application uses persistent volumes with ReadWriteOnce access mode. You need to update the container image from version 1.0 to 1.1. The application's performance degrades if more than one replica is unavailable at any time. The StatefulSet is configured with the default RollingUpdate strategy (partition=0). You have a maintenance window of 30 minutes. The update must be completed within the window with minimal risk. Which of the following approaches should you take?

Accepted Answer

Use the default rolling update with partition=0; the StatefulSet will update one pod at a time automatically.. The default RollingUpdate strategy with partition=0 updates one pod at a time, ensuring that no more than one replica is unavailable at any moment. This matches the application's constraint that performance degrades if more than one replica is unavailable, and the 30-minute window is sufficient for a rolling update of 3 pods.

Answer

Manually delete each pod and let the StatefulSet recreate them with the new image.

Answer

Set maxUnavailable to 2 to speed up the rollout, then update the image.

Answer

Perform a canary update by setting partition to 2, updating one pod, validating, then setting partition to 0.

Question 11

Drag and drop the steps to configure a firewall rule using firewalld to allow HTTPS traffic in the correct order.

Accepted Answer

Step 1: Check the current default zone. Step 2: Add the HTTPS service permanently using --permanent. Step 3: Reload firewalld. Step 4: Verify the rule is active. Step 5: Test connectivity.. Firewalld commands: check zone, add service with --permanent, reload, verify, test.

Answer

Step 1: Add the HTTPS service without --permanent. Step 2: Reload firewalld. Step 3: Verify the rule. Step 4: Test connectivity.

Answer

Step 1: Add the HTTPS service with --permanent. Step 2: Verify the rule without reloading. Step 3: Reload firewalld. Step 4: Test connectivity.

Answer

Step 1: Reload firewalld. Step 2: Add the HTTPS service with --permanent. Step 3: Verify the rule. Step 4: Test connectivity.

Question 12

Match each Ansible playbook directive to its purpose.

Accepted Answer

hosts: Defines the managed hosts or groups. Correct matches: 'hosts' specifies target hosts, 'tasks' lists actions, 'become' enables privilege escalation. Common confusion includes swapping hosts and tasks.

Answer

hosts: Defines variables used throughout the playbook

Answer

tasks: Defines the target hosts or groups

Question 13

An administrator wants to update a web server fleet with minimal downtime. They need to update each server one at a time. Which Ansible playbook directive should be used?

Accepted Answer

serial: 1. The `serial: 1` directive in an Ansible playbook controls the batch size of hosts that are updated simultaneously. Setting it to 1 ensures that only one host is updated at a time, which minimizes downtime by allowing the rest of the fleet to remain available while each server is sequentially updated.

Answer

throttle: 1

Answer

forks: 1

Answer

max_fail_percentage: 0

Question 14

During a rolling update using an Ansible playbook with serial: 2, one host in the first batch becomes unreachable. The playbook fails with an unreachable host error. How should the administrator proceed to complete the update on the remaining hosts while excluding the problematic host?

Accepted Answer

Use 'ansible-playbook playbook.yml --limit all:!hostname' to exclude the unreachable host.. The `--limit` flag with the pattern `all:!hostname` uses Ansible's inventory host pattern syntax to exclude a specific host from the playbook run. This allows the administrator to rerun the playbook against all hosts except the unreachable one, completing the rolling update without re-attempting the failed host. The `serial: 2` setting is irrelevant once the host is excluded, as the playbook will only target the remaining reachable hosts.

Answer

Use 'ansible-playbook playbook.yml --forks 1' to slow down the update.

Answer

Add 'any_errors_fatal: false' to the playbook and rerun.

Answer

Rerun the playbook with the same command; it will skip the unreachable host automatically.

Question 15

A large enterprise manages thousands of servers grouped by data center. They are designing a rolling update that must complete within a maintenance window. Which combination of Ansible strategies best minimizes total update time while maintaining safety?

Accepted Answer

Set serial to 10% and max_fail_percentage to 25%.. Setting `serial: 10%` updates hosts in batches of 10% of the inventory, which parallelizes the update across many hosts to minimize total time, while `max_fail_percentage: 25%` provides a safety net by aborting the play if more than 25% of the batch fails, preventing a cascade of failures from taking down the entire data center. This combination balances speed and safety for large-scale rolling updates within a maintenance window.

Answer

Set serial: 0 to update all hosts simultaneously.

Answer

Set forks to 100 and max_fail_percentage to 50.

Answer

Set serial to 1 to update one host at a time with max_fail_percentage: 0.

Question 16

An administrator notices that during a rolling update, the playbook seems to hang after updating the first host. The playbook uses serial: 5. What is the most likely cause?

Accepted Answer

One of the hosts in the batch is taking too long to complete its tasks.. When `serial: 5` is set, Ansible processes hosts in batches of five. If one host in the batch takes an unusually long time to complete its tasks (e.g., due to a slow network, a hanging service restart, or a long-running command), the entire batch will appear to hang because Ansible waits for all hosts in the current batch to finish before proceeding to the next batch. This is the most likely cause of the observed behavior during a rolling update.

Answer

The playbook has an infinite loop.

Answer

The SSH control path is exhausted.

Answer

The max_fail_percentage is set too high.

Question 17

A team uses Ansible to update a database cluster with one primary and two replicas. The goal is zero downtime. Which update order is the safest?

Accepted Answer

Update replicas first, then the primary.. Updating replicas first ensures that if the update introduces a regression, it affects only the read-only replicas, which can be quickly rolled back without impacting write availability. Once replicas are confirmed healthy, the primary is updated and a controlled failover (e.g., using `patronictl switchover` or `repmgr standby switchover`) promotes a replica to primary, minimizing downtime to seconds. This order aligns with the principle of reducing blast radius and maintaining quorum in a cluster.

Answer

Update in random order.

Answer

Update all nodes simultaneously.

Answer

Update the primary first, then replicas.

Question 18

An organization uses Ansible Tower (AWX) for rolling updates. They have a job template that runs a playbook with serial: 5. The inventory contains 50 hosts. The update fails after the first batch due to a syntax error in a playbook. After fixing the error, the administrator wants to resume updating from where it left off without updating already successful hosts. Which approach achieves this?

Accepted Answer

Use the job template survey to input a list of hosts to skip, and pass it as --limit.. Ansible Tower's job template survey can collect a list of hosts to skip, which is then passed as the `--limit` option to the playbook. This allows the administrator to resume the rolling update from the next batch by excluding the first five already-successful hosts, avoiding re-running the playbook on them.

Answer

Create a new job template with a dynamic inventory subset excluding the first batch hosts.

Answer

Modify the playbook to check if a host has already been updated using a fact and skip it.

Answer

Rerun the entire playbook; Ansible will skip hosts that are already in the desired state.

Question 19

What is the effect of setting 'serial: 5' in an Ansible playbook that targets a group of 20 hosts?

Accepted Answer

The playbook runs on 5 hosts at a time, sequentially.. Setting 'serial: 5' in an Ansible playbook configures the playbook to execute each task on a batch of 5 hosts at a time, moving to the next batch only after the current batch completes all tasks. This ensures that no more than 5 hosts are processed concurrently, providing controlled, sequential rolling updates across the 20-host group.

Answer

The playbook runs on 5 hosts per task, then moves to next task.

Answer

The playbook runs only on the first 5 hosts.

Answer

The playbook runs on all 20 hosts at once.

Question 20

An administrator uses a rolling update strategy with serial: 3 and max_fail_percentage: 20. They have 10 hosts in the inventory. The first batch of 3 hosts: 2 succeed, 1 fails. What happens next?

Accepted Answer

The playbook continues with the next batch of 3 hosts.. The `max_fail_percentage` parameter applies to the total number of hosts, not per batch. With 10 hosts and 20%, up to 2 hosts can fail overall. The first batch had only 1 failure, which is within the limit, so the playbook continues with the next batch of 3 hosts. Options B, C, and D are incorrect because the failure threshold has not been exceeded.

Answer

The playbook retries the failed host, then continues.

Answer

The playbook marks the failed host as unreachable and continues.

Answer

The playbook aborts and no further hosts are updated.