EX294 Timed Practice Test 3 — 10 Questions

Question 1

An Ansible playbook uses 'async' and 'poll' to run a long-running task. The task returns a changed status and the playbook continues. However, the remote server reports that the task failed after the playbook finished. What is the most likely reason?

10 minute time limit — choose an answer to begin.

Accepted Answer

The task's return code was not checked; 'async_status' module should be used to explicitly check the job result.. When a task is launched with `async` and `poll: 0`, Ansible does not wait for the task to complete; it immediately continues the playbook. The task runs in the background on the remote host, and its final result (including failure) is not automatically captured by the playbook. To retrieve the actual exit status and output, you must explicitly use the `async_status` module with the job ID to poll the task until it finishes. Without this explicit check, the playbook may report success even if the background task ultimately fails.

Answer

The 'async' timeout was set too high.

Answer

The 'poll' interval was set too low.

Answer

The playbook used 'ignore_errors: true' on the async task.

Question 2

A team uses execution environments (EE) for job templates. The admin builds a custom EE using `ansible-builder` with a `execution-environment.yml` file that includes a `base_image: registry.redhat.io/ansible-automation-platform-21/ee-minimal-rhel8:latest` and a custom Python requirement. However, the controller reports that the EE is not found when launching a job. What is the most likely issue?

Accepted Answer

The built EE image was not pushed to the container registry specified in the controller's execution environment configuration.. After building a custom execution environment with `ansible-builder`, the resulting container image must be pushed to a container registry that the Automation Controller is configured to access. The controller does not automatically pull images from the local build cache; it references the image by its registry path. If the image is not present in the specified registry, the controller will report that the EE is not found when launching a job.

Answer

The base image is pointing to an incorrect registry path.

Answer

The custom Python requirement needs to be added to `requirements.txt` in the project.

Answer

The execution environment does not include a `Containerfile` for the build process.

Question 3

A playbook requires a secret token that changes every hour. The token is stored in a password vault. Which setting should be used to have Tower retrieve the token at runtime?

Accepted Answer

Use a custom credential type that injects the vault lookup result.. Ansible Tower (now Red Hat Ansible Automation Platform) supports custom credential types that can define input and injector configurations. By using a custom credential type with an injector that includes a lookup plugin (e.g., `{{ lookup('hashi_vault', 'secret/data/token') }}`), Tower can retrieve the secret token from a password vault (like HashiCorp Vault) at runtime, ensuring the token is always current without hard-coding or manual updates.

Answer

Hard-code the token in the playbook.

Answer

Store the token in extra_vars on the job template.

Answer

Store the token in the project as a file.

Question 4

An administrator wants to ensure that Ansible facts gathered from a host are consistent across multiple playbook runs. Which two actions can help achieve this? (Choose two.)

Accepted Answer

Enable fact caching using 'ansible_cache' plugin with a persistent backend like Redis.. Enabling fact caching with a persistent backend like Redis stores gathered facts between playbook runs, ensuring consistency without re-gathering. Option E is correct because setting 'ANSIBLE_GATHERING=smart' with a configured cache_timeout allows Ansible to reuse cached facts within the timeout period, providing consistent data across runs.

Answer

Use 'gather_facts: no' and manually run 'setup' module with specific filter.

Answer

Use 'tags' to only gather facts on selective runs.

Answer

Disable fact caching and gather facts every time.

Question 5

An organization wants to deploy Ansible Automation Platform 2.x in a highly available configuration. Which component must be deployed in an active-active cluster to ensure controller failover?

Accepted Answer

Automation controller. The automation controller is the component that provides the web UI, REST API, and job execution management in Ansible Automation Platform 2.x. For high availability, multiple controller nodes must be deployed in an active-active cluster behind a load balancer, ensuring that if one controller fails, another can immediately take over without service interruption.

Answer

PostgreSQL database

Answer

Private Automation Hub

Answer

Automation mesh

Question 6

A playbook uses 'vars_prompt' to ask for a confirmation before proceeding with destructive changes. However, when the playbook is run from a CI/CD pipeline, it hangs indefinitely. What is the best way to handle this?

Accepted Answer

Pass the variable via --extra-vars and modify the prompt to be conditional with 'when: variable is not defined'.. Passing the variable via --extra-vars and making the prompt conditional with 'when: variable is not defined' allows the pipeline to provide the variable non-interactively. Option A is unsafe. Option B's --check mode does not solve prompts. Option C is unrelated. Option D encrypts data but does not handle prompts. Therefore, E is best.

Answer

Remove the prompt and always proceed.

Answer

Set ANSIBLE_STDOUT_CALLBACK=unixy to avoid interactive prompts.

Answer

Encrypt the confirmation in vault and include it.

Answer

Use --check mode to simulate.

Question 7

A company wants to implement a rolling update for a stateful application where hosts cannot be updated in parallel due to data consistency. They also need to ensure that if any host fails, the entire update is rolled back. Which strategy meets these requirements?

Accepted Answer

Use serial: 1 and any_errors_fatal: yes. Setting `serial: 1` ensures hosts are updated one at a time, preventing parallel updates that could break data consistency for a stateful application. Adding `any_errors_fatal: yes` causes the entire playbook run to abort immediately if any host fails, which satisfies the requirement for a full rollback on failure.

Answer

Use serial: 2 and any_errors_fatal: yes

Answer

Use serial: 1 and ignore_errors: yes

Answer

Use serial: 0 and max_fail_percentage: 0

Question 8

An Ansible playbook fails intermittently due to a service not starting in time. The administrator wants to configure a task to retry until the service confirms it is running. Which Ansible feature should be used?

Accepted Answer

Until loop with retries and delay.. (Until loop with retries and delay) is correct. The 'until' loop in Ansible allows a task to be retried until a condition is met, with configurable retries and delay. Option B (failed_when) defines when a task is considered failed but does not provide retry functionality. Option C (block/rescue) is used for error handling but does not retry the original task. Option D (async with poll) is for running tasks asynchronously and polling for completion, but it does not inherently retry on failure.

Answer

Failed_when with conditional retry.

Answer

Block and rescue to catch failure.

Answer

Async with poll interval.

Question 9

An Ansible playbook uses the "community.general" collection to manage firewall rules. The engineer wants to use a lookup plugin to fetch the current IPv4 address of a host to include in a dynamic inventory script. Which TWO of the following options correctly describe the usage of lookup plugins in Ansible?

Accepted Answer

Lookup plugins are executed on the control node and return data to the Ansible controller.. Lookup plugins in Ansible are designed to run on the control node (the machine where Ansible is executed), not on the remote host. They fetch data from external sources (e.g., files, databases, environment variables) and return that data to the Ansible controller for use in playbooks or inventory scripts. This aligns with the requirement to fetch the current IPv4 address of a host for a dynamic inventory script, as the lookup plugin can query local or network sources without needing to execute on the target host.

Answer

Lookup plugins are always executed on the remote host.

Answer

Lookup plugins must be imported using the "lookup" keyword.

Answer

The "file" lookup plugin reads the content of a file from the remote host.

Question 10

Your organization uses Ansible Tower to manage a growing number of Linux servers. Currently, there is a single inventory called 'All Servers' that contains all hosts. A new project requires that certain sensitive variables (e.g., API keys) be stored securely and not exposed in job logs. The security team also wants to limit which users can use these credentials. You have been asked to implement a solution. After evaluating, you plan to create a custom credential type with a 'password' field for the API key and assign it to the job template. However, during a test run, the API key is still visible in the job output. What is the most likely reason?

Accepted Answer

The playbook contains a debug task that prints the API key variable.. Even if a credential is properly defined and assigned, any task in the playbook that explicitly references the variable (such as a debug task) will output its value in the job log. Ansible Tower's credential hiding only prevents the credential from being displayed in the job template's 'extra variables' or credential details; it does not automatically suppress the variable's value if the playbook itself prints it. The playbook author must use the 'no_log: true' directive on tasks that handle sensitive data to prevent exposure.

Answer

The custom credential type was created with an 'input' field instead of a 'password' field.

Answer

The 'no_log' parameter was not set in the Ansible configuration for the module.

Answer

The credential was not assigned to the job template; it was only assigned to the project.