EX294 Timed Practice Test 1 — 10 Questions

Question 1

Drag and drop the steps to configure an Ansible control node for managing remote hosts into the correct order.

Question 2

Drag and drop the steps to configure a logical volume (LV) using LVM on a new disk in the correct order.

Question 3

Drag and drop the steps to configure a network bond (bond0) using nmcli in the correct order.

Question 4

Drag and drop the steps to configure a container using Podman with a custom Dockerfile in the correct order.

Question 5

Drag and drop the steps to configure a basic NFS server to export a directory in the correct order.

Question 6

Drag and drop the steps to configure a systemd service to start automatically at boot in the correct order.

Question 7

Which two conditions could prevent an automation controller job from starting? (Choose two.)

Accepted Answer

The project sync is pending. Options A and D are correct: a disabled job template cannot start, and a pending project sync can block execution. Option B is wrong: empty inventory may cause zero hosts but job still starts and fails. Option C is wrong: 'latest' tag is valid. Option E is wrong: system auditors can still launch jobs if they have the role.

Answer

The inventory source is empty

Answer

The user is a system auditor

Answer

The execution environment image tag is 'latest'

Question 8

A systems administrator needs to securely store a database password for use in an Ansible playbook. The password should be encrypted at rest and decrypted only at runtime when the playbook is executed. Which approach should the administrator take?

Accepted Answer

Use the ansible-vault encrypt_string command to encrypt the password and store it in a variables file.. Using ansible-vault encrypt_string is the standard method to encrypt sensitive data. Option A (no_log) hides output but the password is still in plain text. Option C (unprotected file) is insecure. Option D (environment variable) can be seen in process listings.

Answer

Store the password as a plain text variable in the playbook and use the no_log: yes directive to prevent logging.

Answer

Store the password in an unprotected external file and reference it with include_vars.

Answer

Save the password in an environment variable and access it via lookup('env','DB_PASS').

Question 9

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. Option A is correct because `ansible-vault` encrypts variable files at rest using AES-256, allowing sensitive data like passwords or API keys to be stored securely in version control. When a playbook runs, the vault password must be provided (e.g., via `--ask-vault-pass` or a vault password file), and Ansible decrypts the file in memory only, never writing plaintext to disk. This ensures that sensitive values are not exposed in the playbook source code or logs.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 10

A workflow template in automation controller consists of three job templates that must run sequentially with different credentials. The first job template uses a machine credential to provision a VM, the second uses a network credential to configure the switch, and the third uses a cloud credential to deploy the application. To secure the credential usage, what should the administrator configure?

Accepted Answer

Set each job template to use the appropriate credential and ensure workflow node permissions are set to 'use credential'.. Each job template can have its own credential defined. The workflow template does not directly hold credentials; it uses the credentials assigned to each job template. Option A (assign to workflow) is not possible. Option C (single credential) is not appropriate. Option D (validation rules) does not exist.

Answer

Create a single credential that covers all three environments.

Answer

Define credential validation rules in the workflow node properties.

Answer

Assign all three credentials to the workflow template directly.