EX294 Manage inventories and credentials Practice Question
A junior admin wants to remove a credential from Ansible Tower. Which role-based access control permission is required to delete a credential?
⚠ Common exam trap
Candidates often confuse the 'Use' role with full management permissions, but 'Use' only allows credential consumption in job templates, not deletion or modification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Admin
In Ansible Tower, the Admin role is the only role that grants full management permissions, including the ability to delete credentials. Lower-level roles like Read, Use, and Execute only allow viewing or using credentials, not modifying or deleting them. This aligns with Tower's RBAC hierarchy where Admin is required for destructive actions on any resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Read
Why it's wrong here
Read grants only viewing rights over credentials, so the delete operation is rejected by the RBAC check. It is tempting because Read is the minimum permission needed to see a credential exists, and it suffices for auditing or listing credentials, but deletion demands the Admin or Credential Admin role.
- ✗
Use
Why it's wrong here
Use allows a user to select a credential when creating or editing a job template, but confers no delete capability on the credential object. Deleting requires Admin role on that credential. Use would be the correct permission when a template creator must attach an existing machine or source-control credential to their job.
- ✗
Execute
Why it's wrong here
Execute permits launching a job template that references the credential; it grants no administrative rights over the credential object itself. Deletion requires the Admin role on that credential. Execute would be the correct permission when a user needs to run playbooks using a stored credential without viewing or altering it.
- ✓
Admin
Why this is correct
Deleting a credential is an administrative operation, so the Admin role is required; lesser roles such as Auditor or Execute only grant read or job-run rights. This satisfies the stem's requirement for the permission that authorises credential deletion.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every EX294 question from scratch — 392 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX294 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX294 exam.