Red Hat Certified Engineer EX294 (EX294) — Questions 1–75

The `upper` filter in Ansible converts each string item in the loop to uppercase. The `loop` directive iterates over the list `['a','b']`, and for each iteration, the `{{ item | upper }}` expression applies the `upper` filter to the current item, resulting in `'A'` and `'B'`. The `debug` module then prints each transformed value as a separate message.

The `:&` syntax in a host pattern performs set intersection, so the play runs only against hosts that are members of both the `web` and `db` groups. The `:` alone would create a union, and a leading `!` would exclude. Because the play uses `web:&db`, the correct target set is the overlap of the two groups.

The `max_fail_percentage` keyword is designed to abort a play when the failure rate within a batch exceeds a given percentage. By setting it to 25, Ansible will stop the rolling update if more than 25% of the hosts in a batch fail, matching the application's availability requirement. This provides an automatic safety check during the update.

Both accepted approaches produce artifacts encrypted with the same vault password that the required --vault-password-file supplies. Inline encryption with encrypt_string hides a single value inside an otherwise readable vars file, while encrypting an entire vars file protects a group of secrets referenced through vars_files. Each keeps clear-text secrets out of the repository while remaining fully usable at run time.

Ansible merges group membership across all loaded inventory sources. When the same group name appears in an INI file and a YAML file, the group ends up containing the union of hosts from both definitions. There is no duplicate error and no format-based precedence for group membership.

The containerized installer is driven by an inventory file in its setup directory that holds both the target host definitions and the platform variables, including the subscription manifest location. Editing this file is the supported way to supply installation parameters before running the setup playbook.

The `ansible-builder` tool uses a definition file (typically `execution-environment.yml`) to construct a container image. During the build process, it generates a `Containerfile` (or `Dockerfile`) that contains the exact instructions for building the container image, such as base image selection, package installation, and collection inclusion. This generated file is the actual artifact that the container runtime (e.g., Podman or Docker) uses to create the execution environment image.

Ansible handlers are deduplicated by name within a play. When a handler is notified multiple times—whether from a role or a playbook task—it runs only once at the end of the play, after all tasks have completed. This prevents redundant executions and is a core design feature of Ansible's handler system.

The `package_facts` module is the best practice for gathering package installation status in Ansible. It populates the `ansible_facts.packages` variable with structured data about installed packages, allowing you to conditionally execute tasks using `when` statements without relying on external commands or file checks. This approach is idempotent, efficient, and aligns with Ansible's declarative philosophy.

In Ansible Tower, credentials are assigned to an organization, but users or teams must be explicitly granted the 'Use' role on a credential to be able to use it in a job template. Team Alpha can use the credential because they likely have the 'Use' role, while Team Beta does not. Granting Team Beta the 'Use' role on 'shared_ssh_key' resolves the permission error.

The `combine` filter in Ansible with `recursive=True` merges two dictionaries, with `user_config` overriding `base_config`, and recursively merges nested dictionaries. This matches the requirement exactly, as `recursive=True` ensures that nested structures are combined rather than replaced outright.

High availability for the automation controller in AAP is achieved by deploying multiple controller nodes behind a load balancer that performs health checks. This ensures that if one node becomes unavailable, traffic is automatically routed to the remaining healthy node, minimizing downtime. Other options do not provide automatic failover for the controller service.

Ansible Automation Controller's Role-Based Access Control (RBAC) allows administrators to assign granular 'Use' permissions to specific users or teams, ensuring that only authorized entities can leverage a credential for job runs. This prevents unauthorized access to sensitive secrets and aligns with the principle of least privilege, which is a core security best practice in automation environments.

Converting a comma-separated string into a list of integers requires two distinct operations. Splitting on the comma produces string tokens, and mapping the int filter over those tokens converts each to a number. Together they yield the desired list of integer ports, which can then be assembled into each dictionary entry, satisfying the normalization requirement without manual iteration.

The `when` conditional in Ansible evaluates a Jinja2 expression to determine whether a task should execute. By using `when: primary`, the task will run only on hosts where the inventory variable `primary` is defined and evaluates to `true` (a truthy value). This directly meets the requirement to target the primary database server.

The `--limit` flag with the pattern `all:!hostname` uses Ansible's inventory host pattern syntax to exclude a specific host from the playbook run. This allows the administrator to rerun the playbook against all hosts except the unreachable one, completing the rolling update without re-attempting the failed host. The `serial: 2` setting is irrelevant once the host is excluded, as the playbook will only target the remaining reachable hosts.

`ansible-galaxy collection publish` is the specific command used to upload a collection tarball to Automation Hub (or any Galaxy server). The `--token` flag provides the required API authentication token for the publish operation. This command sends the tarball to the server's API endpoint, which validates and imports the collection.

The order of filters matters: sorting must happen while the data is still a list, then joining converts it to a string. Applying join before sort would sort characters, and filters like unique or flatten do not impose alphabetical order. Only sorting the list first and then joining with a comma delimiter meets the requirement.

The correct order to configure a network bond using nmcli is: create the bond connection first, then add slave interfaces to it, set the bonding mode (e.g., active-backup), activate the bond, and finally verify the bond status. This sequence ensures that the bond interface exists before adding slaves and that the mode is set before activation so that the bond operates correctly from the start.

`select('truthy')` filters the list to include only elements that evaluate to `true` in Ansible/Jinja2 (non-zero numbers, non-empty strings, etc.), and `first` returns the first such element. The `default('')` provides a fallback if no truthy element exists. This chain correctly extracts `1` from the list `[0, 1, 2, '', 'hello']`.

In Ansible roles, default variables are defined in the `defaults/main.yml` file. These variables have the lowest precedence, meaning they can be easily overridden by playbook variables, inventory variables, or any other variable source with higher precedence. This design allows role authors to provide sensible defaults while giving users the flexibility to customize behavior without modifying the role itself.

The installer requires the external database user to have the `CREATEDB` privilege to create the automation controller and hub databases. Granting this privilege is the correct fix. Other options either ignore the privilege requirement, use an insecure workaround, or modify unrelated connection parameters.

The group_names variable contains the list of groups the current host belongs to. Using a when condition like "'webservers' in group_names" ensures the tasks run only on hosts in that group, regardless of the play's target. This is dynamic and adapts to inventory changes.

When `any_errors_fatal: true` is set and a batch of hosts fails, Ansible immediately aborts the entire playbook run for all remaining hosts, regardless of the `serial` setting. Since the first batch of 2 hosts both fail, no further batches are executed. This behavior is designed to prevent cascading failures in critical deployments.

The `serial` directive in Ansible controls the number of hosts that execute a play at a time, allowing you to limit concurrency. Setting `serial: 5` ensures that only 5 hosts run tasks simultaneously, with the playbook completing in batches of 5 until all hosts are processed.

Ansible-vault can encrypt either entire files (e.g., vars files, role defaults) or individual variables within a YAML file using the `!vault` tag. This flexibility allows you to protect sensitive data at the granularity you choose, without requiring separate encrypted files for each secret.

Firewalld commands: check zone, add service with --permanent, reload, verify, test.

The playbook uses `ansible_facts['ansible_tcpip_socket']['port']` to supply the port number to the `wait_for` module. If fact gathering is disabled (e.g., via `gather_facts: no` at the play level or `ANSIBLE_GATHERING=explicit`), the `ansible_facts` dictionary is empty, so the variable resolves to `None` or an undefined value, causing the task to fail. The error is not a syntax or type issue but a missing fact dependency.

Ansible Tower allows you to create a single inventory with multiple inventory sources, each configured to sync from a different Satellite server. This approach consolidates all host data into one unified inventory without custom scripting or requiring a central aggregator, leveraging Tower's native multi-source inventory capabilities.

In OpenShift, the RollingUpdate strategy for a DeploymentConfig uses the `maxUnavailable` parameter to specify the maximum number or percentage of pods that can be unavailable during the update process. This ensures that the desired number of pods remain available to serve traffic while the update rolls out, controlling the trade-off between update speed and availability.

Ansible allows inline host variable definitions directly in the inventory file using key=value pairs after the hostname. This is a standard syntax where variables like 'http_port=8080' are assigned to the host 'myhost' and become available as Ansible facts during playbook execution. The 'ansible_host' special variable is also defined this way to override the connection address.

Ansible Vault encrypts files and individual values using AES-256 so that secrets can be safely stored in source control. Encrypting the whole variable file with ansible-vault encrypt and loading it through vars_files keeps the plaintext out of Git while playbooks still resolve the variable normally. Decryption happens at runtime using a vault password provided interactively or through a password file.

Ansible Vault encrypts the variable file at rest, and including it via `vars_files` or `include_vars` decrypts it only in memory during playbook execution. This prevents the password from appearing in logs, the command line, or the process table, meeting the security requirement.

The AAP bundled installer reads all deployment variables, including database and admin passwords plus receptor settings, from the inventory file. Editing that file before executing setup.sh is the supported method. Configuration files like ansible.cfg and legacy paths are not consulted for these values, and altering the installer script itself is unsupported.

In Red Hat Enterprise Linux, standard directories follow the Filesystem Hierarchy Standard (FHS). /etc holds configuration files, /home stores user home directories, and /boot contains boot loader files and kernel images. Common confusions include mixing /var (variable data like logs) with /tmp (temporary files) and associating log files incorrectly with /tmp.

B is correct because the 'Permission denied' error on a task that runs successfully on some hosts but not others, despite a verified credential, typically indicates a privilege escalation issue. The become method (e.g., sudo, su, pbrun) may be configured differently or unsupported on the failing hosts, causing Ansible to fail when attempting to escalate privileges for the task. Since the credential is correct, the failure occurs during the become process, not authentication.

The `ansible-builder build` command is the correct tool to create an execution environment image from an `execution-environment.yml` definition. It parses the definition, installs collections and Python dependencies, and produces a container image. Other commands like `ansible-galaxy collection build` or `podman build` serve different purposes and do not automate the execution environment creation process.

Filtering a list of dictionaries by a boolean attribute and then extracting a specific key is a common data transformation. The `selectattr` filter is designed to filter by attribute, `map(attribute=...)` extracts the desired key, and `join` combines the results into a string. The order of operations is critical: filter first, then map, then join.

Common systemd unit types include service (manages daemons), socket (manages IPC/network sockets), timer (schedules events), and mount (controls mount points). Be careful not to confuse timer with service.

Role-based access control (RBAC) on job templates is the correct feature because it allows an administrator to assign specific permissions (e.g., execute, read, or admin) to users or teams for individual job templates in Ansible Automation Platform (AAP). This directly restricts which users can launch specific job templates without affecting other resources.

It uses the `ternary` filter to check if `item.ports` is a string; if true, it splits the string by commas into a list, otherwise it keeps the existing list. This ensures the `ports` field is always normalized to a list of integers, handling both inconsistent input formats.

Setting `poll: 0` with the `async` keyword launches the task in the background without waiting for it to complete, and the `async_status` module can then be used later to check the task's status by referencing its job ID. This allows the playbook to continue executing other tasks while the long-running task runs asynchronously.

The `default` filter in Ansible is specifically designed to provide a fallback value when a variable is undefined or evaluates to an empty string (with the `omit` parameter). It is the idiomatic way to handle missing or empty variables in Jinja2 templates within Ansible playbooks, ensuring idempotency and avoiding undefined variable errors.

SELinux for web: create dir, set context, verify, configure Apache, restart and test.

The ansible-inventory --list command is designed to parse an inventory source and emit the resulting groups, hosts, and variables as JSON. It is the definitive tool for confirming how Ansible interprets an inventory file, including group membership and host listing.

Setting ansible_user in [group:vars] sections of the inventory file assigns the correct SSH user to all hosts in each group. This is a standard inventory feature that automatically applies group-specific connection variables. It requires no playbook modifications and ensures the right user is used for web and db hosts without manual per-host configuration.

The `default(required=true)` filter in Ansible explicitly marks the variable as required. If `my_var` is undefined, the filter raises an error because it enforces that the variable must be provided, causing the task to fail with an error message. This is a deliberate mechanism to catch missing mandatory variables early in playbook execution.

Scaffolding a new collection requires the dedicated `ansible-galaxy collection init` subcommand, which generates the namespace/name directory tree plus a `galaxy.yml` manifest. Role initialization, building, and installing all operate on artifacts that already exist and therefore cannot produce the initial skeleton needed before a custom role is placed under `roles/`.

The `join` filter in Ansible is designed to concatenate list elements into a single string using a specified delimiter. Applying `join(',')` to `server_list` will produce a comma-separated string, exactly as required for the API call.

Setting `serial: 1` ensures that only one host is updated at a time, which is the safest way to perform a rolling update without overwhelming the load balancer or causing a service outage. This allows the playbook to complete the full update cycle (disable, update, re-enable) for each host before moving to the next, minimizing the number of hosts out of service simultaneously.

D is correct because `bindep.txt` specifies system-level package dependencies (like `openssh-clients` or `sshpass`) that must be installed in the container image. When building an execution environment, `ansible-builder` reads `bindep.txt` to install RPM packages via `dnf` (or `apt` on Debian-based images). If SSH packages are missing, the `bindep.txt` file is the most likely place to add them, as it directly controls which system packages are included in the final image.

The error indicates the package is not available. This is typically due to missing or incorrect repository configuration. The playbook itself and role syntax are valid.

The execution environment build process uses the requirements.yml file to determine which collections to include in the image. If the custom collection 'my_company.network' depends on 'cisco.ios', but that dependency is not explicitly listed in the requirements.yml, the builder will not include 'cisco.ios' in the execution environment. Adding 'cisco.ios' to the requirements.yml ensures it is installed during the build, making the module available at runtime.

Smart inventories in Ansible Tower allow you to apply a filter (using Jinja2-style syntax) against an existing inventory source, such as a dynamic VMware vCenter source, to limit execution to hosts matching specific criteria like a custom attribute. This approach avoids modifying the source script or creating duplicate inventory sources, preserving the dynamic nature of the inventory while enabling targeted host selection.

B is correct because signature verification of a downloaded collection requires the client to have the corresponding public key that was used to sign the collection. If the user's client lacks this public key, the verification process will fail, even if the collection itself is properly signed and the URL is valid.

Ansible Tower allows dynamic inventory groups to be nested under static groups, enabling a hybrid inventory structure where cloud-sourced hosts can be organized within manually defined static groups for more flexible automation targeting. This is supported by the Tower inventory model, which merges static and dynamic sources into a unified group hierarchy.

Lookup plugins execute on the control node and query external data sources during a play run, which is the supported way to pull secrets from services such as HashiCorp Vault. Assigning the lookup result to a variable with set_fact makes the secret usable by later tasks while keeping it out of the repository entirely.

When an execution environment is stored in a private registry that requires authentication, the automation controller must have the registry's URL and credentials configured as a container registry credential. This credential is then used by the controller to authenticate and pull the execution environment image during job runs. Without this, the controller cannot access the private registry, resulting in the 'execution environment not found' error.

When the Automation Hub server is already configured in ansible.cfg under the [galaxy] section with the server_url and auth_url, the ansible-galaxy collection install command will automatically use that server and its authentication. No additional flags are needed; the command simply specifies the collection name in the format namespace.collection.

The SSH private key must be defined as a field with `"type": "string"`, `"multiline": true` (since SSH keys are multi-line), and `"secret": true` (to encrypt the value in the database). This matches the standard Ansible Tower custom credential type schema for storing sensitive key material.

The task must run only when web_package is defined and its value is httpd, without failing if undefined. The condition using 'is defined' followed by 'and' correctly short-circuits so that the variable is only compared when it exists. The other conditions either fail on undefined variables, run when the variable is missing, or use incorrect logic.