EX294 Manage task execution and roles Practice Test 4 — 15 Questions

Question 1

A DevOps engineer wants to run an Ansible playbook inside a specific execution environment (EE) that includes custom collections. The EE image is stored in a private registry requiring authentication. The engineer has configured a container credential file. Which command will execute the playbook using the EE and the credential file?

Accepted Answer

ansible-navigator run -m stdout --ce docker --container-image registry.example.com/custom-ee --container-auth-file auth.json. Option B is correct because ansible-navigator uses the --container-auth-file option to provide authentication details for the container registry. Option A uses an invalid option --container-credential-file. Option C uses the wrong file format (credentials.yml is not typically used for auth). Option D lacks authentication entirely.

Answer

ansible-navigator run -m stdout --ce docker --container-image registry.example.com/custom-ee --container-auth-file credentials.yml

Answer

ansible-navigator run --pp never --ce docker --container-image registry.example.com/custom-ee

Answer

ansible-navigator run -m stdout --pp never --ce docker --container-image registry.example.com/custom-ee --container-credential-file credentials.yml

Question 2

Refer to the exhibit. An Ansible playbook task fails with 'Missing sudo password'. The playbook runs against a server where the remote user 'admin' has sudo privileges but requires a password. Which configuration change would resolve this issue?

Accepted Answer

Set ansible_become_password or use the -K flag when running the playbook.. Option B is correct because the error indicates that sudo requires a password and Ansible does not have it. Setting ansible_become_password provides the password. Option A is incorrect because the become_user is valid. Option C is incorrect because the user does have sudo privileges but requires a password. Option D is incorrect because changing to 'su' would use a different authentication method and is unnecessary.

Answer

Change become_method to su to avoid password prompts.

Answer

Remove the become_user line and rely on default root.

Answer

Change become_user to root.

Question 3

An administrator has a requirements.yml file specifying roles from multiple sources: a public Galaxy server, a private Git repository, and a local path. They want to install all roles into the roles directory of the current project. Which command will achieve this?

Accepted Answer

ansible-galaxy install -r requirements.yml --roles-path ./roles. Option B is correct because ansible-galaxy install with -r reads the requirements file and --roles-path specifies the target directory. Option A uses -p . which installs into the current directory, not the roles subdirectory. Option C installs collections, not roles. Option D uses --force which is unnecessary and may overwrite existing roles.

Answer

ansible-galaxy collection install -r requirements.yml

Answer

ansible-galaxy install -r requirements.yml -p .

Answer

ansible-galaxy role install --force -r requirements.yml

Question 4

A playbook needs to load encrypted variables from a file vault.yml. The vault password is stored in a file vault-pass with restricted permissions. Which method securely loads the variables when running the playbook?

Accepted Answer

Run ansible-playbook playbook.yml --vault-password-file vault-pass. Option C is correct because running ansible-playbook with --vault-password-file specifies the file containing the vault password, which is a best practice. Option A would fail because the encrypted file cannot be read without the vault password. Option B prompts for the password, which is less secure in automation. Option D sets an environment variable, which could be insecure if the session is shared.

Answer

Use include_vars: file: vault.yml without any additional configuration.

Answer

Run ansible-playbook with --ask-vault-pass to prompt for the password.

Answer

Set the environment variable ANSIBLE_VAULT_PASSWORD_FILE in the user's profile.

Question 5

A team develops a custom Ansible role 'webserver' that depends on another role 'common'. They want to ensure that when 'webserver' is used, 'common' is automatically installed from the same Galaxy server. Which approach should they use?

Accepted Answer

Add a dependencies: ['common'] to the role's meta/main.yml file.. Option A is correct because role dependencies are declared in the meta/main.yml file using the 'dependencies' key, which causes ansible-galaxy to automatically install dependent roles. Option B relies on a requirements.yml file, which is not automatically processed when using the role. Option C requires manual intervention. Option D works but does not automate installation of the dependency.

Answer

Add a requirements.yml file in the role's root directory specifying common.

Answer

Use ansible-galaxy install webserver --with-dependencies to install common separately.

Answer

Include the 'common' role in the playbook before 'webserver'.

Question 6

An Ansible playbook that installs packages and configures services is not idempotent. Which two practices should be implemented to make it idempotent? (Choose two.)

Accepted Answer

Use the command module with the 'creates' parameter.. Options A and B are correct. Using state=present for package installation ensures the package is installed only if not present, making it idempotent. Using the command module with the 'creates' parameter ensures the command runs only if the specified file does not exist. Options C, D, and E do not directly address idempotency.

Answer

Use notify handlers to restart services only on change.

Answer

Use check_mode: yes to preview changes.

Answer

Set always_run: yes on tasks.

Question 7

An administrator has a playbook with tasks tagged 'install', 'configure', and 'service'. There are no untagged tasks. They want to run only the tasks tagged 'install' and 'configure', skipping 'service'. Which three commands will achieve this? (Choose three.)

Accepted Answer

ansible-playbook site.yml --tags install,configure. Options A, B, and C are correct. A uses --tags with both tags. B uses separate --tags options which accumulate. C uses --skip-tags to exclude service, which works because there are no untagged tasks. D and E are incorrect because they include only one tag or exclude the wrong tags.

Answer

ansible-playbook site.yml --tags configure --skip-tags install,service

Answer

ansible-playbook site.yml --tags install --skip-tags service

Question 8

You are responsible for managing a large fleet of web servers running Red Hat Enterprise Linux 8. You have an Ansible playbook that deploys a custom web application. The playbook uses several roles from Ansible Galaxy and includes tasks that require root privileges. Recently, users reported that the deployment fails intermittently with the error 'Timeout (12s) waiting for privilege escalation prompt'. You suspect that the issue is related to the become method and the SSH connection. The current inventory uses 'ansible_user: deploy' and 'ansible_become: yes' with default settings. The 'deploy' user has sudo privileges with NOPASSWD for all commands. However, the timeout occurs only on high-latency connections. Which change would most effectively resolve the timeout issue?

Accepted Answer

Increase the 'timeout' setting in ansible.cfg to 30 seconds.. Option C is correct because increasing the 'timeout' parameter in ansible.cfg (or setting ANSIBLE_TIMEOUT) gives more time for privilege escalation prompts on slow connections. Option A is incorrect because SSH pipelining can reduce round trips but does not directly address the timeout. Option B is incorrect because parallel execution increases load and may exacerbate timeouts. Option D is incorrect because the error indicates a privilege escalation timeout, not a missing password.

Answer

Increase 'forks' to 20 to run more tasks in parallel.

Answer

Enable pipelining by setting 'pipelining = True' in ansible.cfg.

Answer

Set 'ansible_become_password' in the inventory.

Question 9

Your organization uses Red Hat Ansible Automation Platform (AAP) to manage job execution. You have created a job template that runs a playbook to configure application servers. The playbook uses a custom credential to access a remote database. Recently, the job started failing with 'Authentication failed' when connecting to the database. You have verified that the database credentials are correct. The credential in AAP is of type 'Machine' and is assigned to the job template. The playbook uses the 'mysql_db' module. Which step should you take to troubleshoot and resolve the issue?

Accepted Answer

Change the credential type to 'Database' and provide the appropriate username and password.. Option B is correct because the 'mysql_db' module typically requires a database credential type, not a machine credential. The credential type must match the module's needs. Option A is incorrect because extra variables would override inventory but not fix the credential type. Option C is incorrect because the vault provides a different mechanism; the credential type is the core issue. Option D is incorrect because the issue is not about SSH keys.

Answer

Add the database password as an extra variable in the job template.

Answer

Modify the machine credential to include the database password as an SSH key.

Answer

Encrypt the database password using Ansible Vault and include it in the playbook.

Question 10

You need to run an Ansible playbook every hour to update a dynamic inventory file from a CMDB API. The playbook is stored in /opt/ansible/update_inventory.yml. You want to schedule the execution using a cron job on the control node. The control node runs Red Hat Enterprise Linux 9. The playbook uses Ansible Vault to decrypt API credentials, and the vault password is stored in /etc/ansible/.vault_pass. Which cron entry will execute the playbook hourly?

Accepted Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml. Option A is correct because it specifies the correct cron schedule (0 * * * * for hourly) and uses full paths to ansible-playbook, vault password file, and playbook. Option B uses the wrong schedule (every minute). Option C uses ansible command instead of ansible-playbook. Option D has an incorrect path for the vault password file.

Answer

0 * * * * /usr/bin/ansible-playbook --vault-password-file ~/.vault_pass /opt/ansible/update_inventory.yml

Answer

* * * * * /usr/bin/ansible-playbook --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Answer

0 * * * * /usr/bin/ansible --vault-password-file /etc/ansible/.vault_pass /opt/ansible/update_inventory.yml

Question 11

Your team uses ansible-pull to manage configuration of a large number of remote nodes. Each node is configured to pull the latest playbook from a Git repository every 30 minutes. Recently, some nodes started reporting 'ERROR! the role 'base' was not found'. The playbook depends on roles from a requirements.yml file that is stored in the same repository. The ansible-pull command on each node uses the default roles path (~/.ansible/roles). The Git repository contains the requirements.yml file but does not contain the actual role directories. What is the most likely cause and solution?

Accepted Answer

Add a pre_task to the playbook that runs 'ansible-galaxy install -r requirements.yml' before the roles are used.. Option C is correct because ansible-pull does not automatically install roles from requirements.yml; the playbook should include a pre_task that runs 'ansible-galaxy install -r requirements.yml' before using the roles. Option A is incorrect because the roles are already in the repository? No, they are not. Option B is incorrect because ansible-pull does not use a local roles path by default; the issue is missing installation. Option D is incorrect because the control node is not involved in ansible-pull.

Answer

Run ansible-galaxy install on the control node and distribute the roles via a separate channel.

Answer

Add the role directories directly to the Git repository and modify the playbook to reference them with a relative path.

Answer

Set the 'roles_path' in ansible.cfg on each node to include the repository's roles directory.

Question 12

Which TWO of the following statements about Ansible roles are correct?

Accepted Answer

Variables in 'defaults/main.yml' have the lowest precedence and can be overridden by inventory variables.. Variables in defaults/main.yml have the lowest precedence and can be overridden by inventory variables. Role dependencies are defined in meta/main.yml. The other options are incorrect: pre_tasks run before roles, include_role is dynamic, and the naming convention is not mandatory.

Answer

Role names must be prefixed with 'ansible-role-' when published to Ansible Galaxy.

Answer

The 'include_role' module can only be used for static imports.

Answer

A role's tasks are executed before any 'pre_tasks' defined in the playbook.

Question 13

Refer to the exhibit. An administrator runs the playbook but the wait_for task fails. What is the most likely cause?

Accepted Answer

The ansible_facts variable may not be available because fact gathering is disabled.. The wait_for task uses ansible_facts, which are not gathered by default unless fact gathering is enabled. Since there is no gather_facts directive or it is set to false, ansible_facts will be empty, causing the task to fail. Option B is correct. Option A is incorrect because delegate_to is fine on localhost. Option C is incorrect because http_port is defined. Option D is incorrect because wait_for accepts strings for port.

Answer

The http_port variable is misspelled.

Answer

The wait_for module requires the 'port' parameter to be an integer.

Answer

The delegate_to should be set to the remote host.

Question 14

A team is automating server configuration using Ansible. They have a custom role 'security' that updates firewall and SSH settings. They notice that when they apply the role to multiple hosts, the SSH configuration changes sometimes fail because the firewall blocks the SSH port before the SSH configuration is updated. They need to ensure that SSH configuration is updated first, then firewall rules are applied. They have defined both tasks in the same role. What should they do?

Accepted Answer

Split the role into two separate roles and use role dependencies to enforce order.. The best approach is to split the role into two separate roles and use role dependencies to enforce order. Role dependencies, defined in meta/main.yml, allow specifying that one role must run before another. By creating a 'ssh_config' role and a 'firewall' role, and setting the firewall role to depend on the ssh_config role, the correct order is guaranteed. Option B is invalid (no 'order' directive). Tags do not control task order within a role. Pre_tasks/post_tasks are play-level constructs and do not apply to role-internal order.

Answer

Use tags to control the sequence of tasks.

Answer

Use pre_tasks for SSH and post_tasks for firewall in the playbook.

Answer

Use the 'order' directive in the playbook to specify task order within the role.

Question 15

Refer to the exhibit. An administrator runs a playbook in check mode and receives the shown output. What should be done to fix the failure while maintaining idempotency?

Accepted Answer

Add a task in the apache role to create the /var/www/html directory using the file module.. The deploy role fails because /var/www/html does not exist. The apache role should ensure the directory exists, typically by including a task to create it. Adding a file module task in the apache role to create /var/www/html would fix the issue.

Answer

Modify the deploy role to use the force parameter when copying files.

Answer

Run the playbook without check mode to force the deployment.

Answer

Add a pre_task in the playbook to create /var/www/html before roles execute.