EX294 Timed Practice Test 2 — 10 Questions

Question 1

An Ansible automation is used to manage firewall rules on a set of Linux servers. The playbook defines a variable "allow_rules" as:
allow_rules:
  - proto: tcp
    dport: 80
    comment: HTTP
  - proto: tcp
    dport: 443
    comment: HTTPS

The engineer needs to use the "iptables" module to create rules. The module expects "chain" to be specified, and the engineer wants to dynamically set the chain based on the port: ports 80 and 443 go to "INPUT" chain, while others go to "FORWARD". The engineer writes a loop:
- name: Add iptables rules
  iptables:
    chain: "{{ item.dport | map('some_filter') }}"
    protocol: "{{ item.proto }}"
    destination_port: "{{ item.dport }}"
    comment: "{{ item.comment }}"
  loop: "{{ allow_rules }}"

But this fails because the chain field expects a string, not a list. The engineer realizes the map filter returns a list. Which of the following modifications correctly sets the chain based on port number?

Accepted Answer

chain: "{{ (item.dport in [80,443]) | ternary('INPUT', 'FORWARD') }}". It uses the `ternary` filter to evaluate a condition (`item.dport in [80,443]`) and return 'INPUT' if true, or 'FORWARD' if false. This produces a single string, which is exactly what the `chain` parameter expects, avoiding the list output from `map`.

Answer

chain: "{{ item.dport | regex_replace('^(80|443)$', 'INPUT') | default('FORWARD', true) }}"

Answer

chain: "{{ item.dport | select('in', [80,443]) | list | first | default('FORWARD') }}"

Answer

chain: "{{ item.dport | replace('80','INPUT') | replace('443','INPUT') | default('FORWARD') }}"

Question 2

An Ansible playbook retrieves a JSON response from an API and stores it in the variable `api_response`. The JSON structure is a list of objects, each with keys `name`, `status`, and `id`. The team needs to create a list of names for objects where status is 'active'. Which filter should be used?

Accepted Answer

{{ api_response | selectattr('status', 'equalto', 'active') | map(attribute='name') | list }}. It uses `selectattr` to filter the list of objects to only those where `status` equals 'active', then `map` to extract the `name` attribute from each filtered object, and finally `list` to convert the result into a list. This is the standard Ansible approach for filtering a list of dictionaries and extracting specific keys.

Answer

Answer

Answer

Question 3

A playbook must execute a task on a host that is not part of the inventory, such as a temporary cloud instance. The task should run on that host without modifying the inventory file. Which directive should be used?

Accepted Answer

add_host. The add_host module is designed to add hosts to the in-memory inventory at runtime, enabling tasks to run on hosts not present in the static inventory. Other directives like delegate_to, local_action, and include_vars serve different purposes and do not add hosts.

Answer

local_action

Answer

delegate_to

Answer

include_vars

Question 4

Refer to the exhibit. What is the purpose of the 'failed_when' condition?

Accepted Answer

It fails the task only if the return code is non-zero and the error does not indicate 'not installed'.. The 'failed_when' condition in Ansible allows you to define custom failure criteria for a task. In the exhibit, the condition 'failed_when: result.rc != 0 and "not installed" not in result.stderr' means the task will only be marked as failed if the return code is non-zero AND the error message does not contain the string 'not installed'. This is useful when a command returns a non-zero exit code for expected reasons (e.g., package not found), and you want to treat that as a non-failure.

Answer

It ensures the task never fails regardless of return code.

Answer

It fails the task only if the package is installed.

Answer

It fails the task if the package is not installed.

Question 5

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. Option A is correct because ansible-vault encrypts sensitive files such as variable files (for example, vars.yml or group_vars files), so secrets like passwords and API keys are stored in ciphertext rather than readable plain text, and they can be decrypted at runtime with a vault password. Option B is correct because setting no_log: true on a task suppresses logging of that task's command output and arguments, preventing sensitive values such as passwords or tokens from being written into Ansible logs or console output. Option C is incorrect because using the debug module with increased verbosity would print sensitive values such as passwords to output, which is the opposite of protecting them. Option D is incorrect because avoiding become: yes does not protect secrets; privilege escalation is unrelated to whether sensitive data is encrypted or hidden, and become is often legitimately needed for secure tasks. Option E is incorrect because storing credentials in plain text in the inventory exposes them directly and is a classic insecure practice, not a protection measure.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 6

A playbook uses the 'block' and 'rescue' keywords to handle errors. The block contains three tasks. The first task fails. What happens next?

Accepted Answer

The rescue section runs immediately after the failure.. In Ansible, when a task inside a `block` fails, the `rescue` section is executed immediately after the failure, without running any remaining tasks in the block. This is analogous to a try-catch mechanism in programming: the block is the 'try', and the rescue is the 'catch'. Option B correctly describes this behavior.

Answer

The rescue section runs and retries the failed task.

Answer

The playbook fails with an error message.

Answer

The remaining tasks in the block run, then the rescue section runs.

Question 7

A playbook uses `{{ my_var | default('fallback') }}`. What is the effect?

Accepted Answer

If `my_var` is undefined, the expression evaluates to 'fallback'.. The `default` filter in Ansible (also known as `d()`) returns the specified fallback value only when the variable is undefined. If `my_var` is defined but empty or None, the filter returns the variable's value (empty string or None), not the fallback. This behavior is specific to the `default` filter's default mode; to also catch empty or None values, you must use `default('fallback', true)`.

Answer

If `my_var` is defined but empty, the expression evaluates to 'fallback'.

Answer

If `my_var` is defined but equal to None, the expression evaluates to 'fallback'.

Answer

The filter raises an error because 'default' is not a valid filter.

Question 8

Refer to the exhibit. An administrator runs a playbook in check mode and receives the shown output. What should be done to fix the failure while maintaining idempotency?

Accepted Answer

Add a task in the apache role to create the /var/www/html directory using the file module.. The failure in check mode indicates that the /var/www/html directory does not exist, and the apache role's copy task cannot write to it. The correct fix is to add a task in the apache role that uses the file module to create the directory with the desired state (e.g., state: directory), ensuring idempotency because the task will only create it if absent. This keeps the role self-contained and maintains idempotent behavior.

Answer

Modify the deploy role to use the force parameter when copying files.

Answer

Run the playbook without check mode to force the deployment.

Answer

Add a pre_task in the playbook to create /var/www/html before roles execute.

Question 9

An operations team is designing a rolling update for a stateful application that requires quorum (minimum 3 out of 5 nodes online). They plan to use Ansible's serial keyword. Which serial value ensures the update proceeds without breaking quorum while still being efficient?

Accepted Answer

serial: 2. Setting serial: 2 ensures that only 2 nodes are taken down at a time during the rolling update. With a quorum requirement of 3 out of 5 nodes, taking down 2 nodes leaves 3 online, maintaining quorum. This is the most efficient value that does not risk breaking quorum.

Answer

serial: 1

Answer

serial: 3

Answer

serial: 5

Question 10

You are managing a large infrastructure of 500 Linux servers. The servers are divided into groups: 'web', 'app', and 'db'. Each group has specific configuration requirements. You have developed a set of Ansible roles to manage these configurations. Recently, you noticed that when you run the playbook against all servers, the 'web' role is applied to 'app' servers due to a variable misconfiguration. The playbook uses include_role with a variable that determines which role to apply. The variable is defined in group_vars/all.yml as 'server_role: web'. However, each group should have its own role: 'web' for web servers, 'app' for app servers, 'db' for db servers. The playbook includes the role based on '{{ server_role }}'. What is the best course of action to fix this issue without modifying the playbook structure?

Accepted Answer

Define the server_role variable in group_vars/web.yml, group_vars/app.yml, and group_vars/db.yml with the appropriate values.. Ansible's variable precedence dictates that group_vars/<group_name>.yml files override group_vars/all.yml for hosts in that group. By defining `server_role` per group file (web, app, db), each server gets the correct role without modifying the playbook structure. This leverages Ansible's built-in group variable inheritance to resolve the misconfiguration cleanly.

Answer

Change the variable in group_vars/all.yml to a list and use 'include_role' with loop.

Answer

Add a 'when' condition to the include_role task to check the group name.

Answer

Define the server_role in host_vars for each server.