Red Hat Certified Engineer EX294 (EX294) — Questions 301–375

Why this answer

How to eliminate wrong answers

Option A is wrong because a job template with an 'execute' role controls who can run a job, not who can update inventory host variables or group memberships; it does not provide inventory modification permissions. Option B is wrong because making WebTeam organization administrators grants them broad administrative rights across the entire organization, not just the inventory, which violates the principle of least privilege and could allow unintended modifications to other resources. Option D is wrong because the 'use' role on an inventory allows a user to use the inventory in a job template (i.e., associate it with a job), but it does not grant permission to update host variables or group memberships; only 'admin' or 'write' roles provide those modification capabilities.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because user-level permissions without organizations or teams do not scale for multi-tenant environments and cannot enforce credential isolation at the organizational boundary. Option C is wrong because a single organization with three teams does not provide sufficient resource isolation; projects, inventories, and credentials would still be visible across teams unless explicitly restricted, and credential viewing cannot be fully prevented at the job template level. Option D is wrong because setting credentials to 'read-only' does not prevent users from viewing the credential values; read-only only prevents editing, not viewing secret fields, and a single team with admin permissions violates the RBAC mandate entirely.

Why this answer

How to eliminate wrong answers

Option B is wrong because the package_manager_path should be /usr/bin/dnf only if the base image uses DNF; however, many execution environment base images (like the default ansible-runner) use microdnf or a different package manager, and the path is typically auto-detected by Ansible Builder. Option C is wrong because the version field in execution-environment.yml is optional and does not cause build failures; it is used for metadata and has no impact on package installation. Option D is wrong because a misspelled base image name would cause a pull error (e.g., 'image not found'), not a build failure related to package conflicts.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because notification templates are optional for approval nodes; they are used to send email or other notifications when an approval is pending, but they are not required for the approval node to be created. Option C is wrong because setting the timeout to 0 means the approval node will wait indefinitely (no timeout), not that it is skipped; a timeout of 0 does not cause the node to be bypassed. Option D is wrong because inventory machine credentials are irrelevant to the creation of an approval node; they are used for connecting to managed hosts, not for workflow approval logic.

Why this answer

How to eliminate wrong answers

Option A is wrong because `ansible-vault rekey` changes the vault password used to encrypt the file, not decrypt or display its contents. Option B is wrong because `ansible-vault decrypt` permanently decrypts the file and writes the plaintext to disk, which modifies the file. Option D is wrong because `ansible-vault edit` decrypts the file, opens it in an editor, and re-encrypts it upon saving, which modifies the file even if no changes are made.

Why this answer

How to eliminate wrong answers

Option B is wrong because projects in Ansible Automation Controller are used to store playbooks and source code, not credentials; credentials are stored separately in the Credentials resource and are not scoped by project. Option C is wrong because setting 'Use' permission on credentials for specific users does not prevent users from other organizations from accessing those credentials if they are not properly scoped to an organization; organization-level isolation is required. Option D is wrong because teams are subgroups within an organization and do not provide cross-organization isolation; users from different organizations could still be placed in the same team, and team-based restrictions do not enforce organizational boundaries.

Why this answer

How to eliminate wrong answers

Option A is wrong because the execution nodes are subscribed to the same local repository that was used to install the automation controller and hub, so they have the required AAP packages; the issue is about collection access, not package availability. Option B is wrong because the error occurs at job template creation, not during job execution, and the controller communicates with execution nodes only when a job runs, not during template creation. Option C is wrong because execution nodes must be registered with the controller to run jobs, but the error occurs before any job execution attempt, and registration status does not affect the controller's ability to find collections on the hub.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the package_manager_path is correctly set to /usr/bin/microdnf for the specified RHEL 8 base image, which uses microdnf as its package manager; changing it to /usr/bin/yum would be incorrect. Option C is wrong because the galaxy.yml file is used for Ansible Galaxy content collections, not for Python package dependencies like 'requests'. Option D is wrong because the base image 'ee-minimal-rhel8' is appropriate for this execution environment; 'ee-supported-rhel8' is not a standard Red Hat image name and would not resolve the missing Python dependency.

Why this answer

How to eliminate wrong answers

Option B is wrong because it assumes the group variable value '80' is used, but host variables override group variables in Ansible's variable precedence. Option C is wrong because it incorrectly states that the group variable overrides the host variable; in reality, host variables have higher precedence than group variables. Option D is wrong because 'http_port' is defined both as a host variable for 'web2' and as a group variable for 'webservers', so it is not undefined and will not cause an error.

Why this answer

How to eliminate wrong answers

Option A is wrong because an outdated syntax would typically cause a syntax error or deprecation warning, not an 'undefined filter' error specific to a missing plugin. Option C is wrong because while FQCN is recommended for clarity, omitting it does not cause 'undefined filter' if the filter is correctly placed and the collection is in the search path; Ansible will still resolve short names if the collection is listed in the playbook's `collections` directive. Option D is wrong because a missing dependency in `galaxy.yml` affects installation of dependent collections, not the loading of a filter plugin within the same collection.

Why this answer

How to eliminate wrong answers

Option A is wrong because the user verified the server URL is correct, and a connectivity issue would typically produce a timeout or connection refused error, not an authentication error. Option B is wrong because the `ansible-galaxy collection build` command completed successfully, which includes integrity checks; a corrupted tarball would likely cause a build failure or a checksum mismatch during upload, not an authentication error. Option C is wrong because content policy violations (e.g., disallowed modules) would result in a policy rejection error message, not an authentication error — the hub would accept the token but refuse the content based on policy rules.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `ansible-galaxy install` is used for installing roles, not collections; collections require the `collection` subcommand. Option C is wrong because `ansible-galaxy collection search` only searches for collections in Galaxy but does not install them, so the module would remain unavailable. Option D is wrong because while it specifies a version (`1.0.0`), the question does not require a specific version; the generic install command is sufficient, and pinning an arbitrary version may cause compatibility issues or fail if that version does not exist.

Why this answer

How to eliminate wrong answers

Option A is wrong because `galaxy-requirements.yml` is used to specify Ansible Galaxy content collections, not Python packages. Option B is wrong because `ansible-navigator` is a runtime tool for running execution environments, not for installing dependencies during the build; Python dependencies must be defined at build time. Option D is wrong because `collection-requirements.yml` is another name for a file that lists Ansible collections, not Python packages.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the 'common' role is explicitly listed in the playbook's roles, so it will run at least once; dependencies do not prevent the initial role execution. Option C is wrong because the 'allow_duplicates: false' setting is evaluated globally across all roles and dependencies, not based on the order of roles; the role will run only once regardless of order. Option D is wrong because 'allow_duplicates: false' explicitly prevents duplicate runs, so the role cannot run twice even if it appears both as a direct role and as a dependency.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `ansible-vault decrypt` permanently decrypts the file to plaintext on disk, which would expose the password in the filesystem and potentially in logs or history if the file is later read. Option C is wrong because `ansible-vault rekey` is used to change the vault password (encryption key) itself, not to edit the content of the encrypted file. Option D is wrong because `ansible-vault view` only displays the decrypted content to stdout (terminal), which would expose the password in the terminal output and potentially in scrollback or logs, without allowing any editing.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `ansible_distribution_version` returns the version string (e.g., '7.9'), but the `version` filter does not output the version itself; it evaluates a comparison and returns a boolean. Option B is wrong because the `version` filter is a valid Jinja2 filter in Ansible and will not cause an error when used correctly with a version string and comparison operator. Option C is wrong because the comparison `'7.9' >= '7.9'` is true, not false, so the output cannot be `False`.

Why this answer

How to eliminate wrong answers

Option A is wrong because an outdated ansible-builder version would not cause this specific manifest mismatch error; it might cause other build failures or deprecation warnings, but the error is architecture-related. Option B is wrong because invalid syntax in the definition file typically results in YAML parsing errors or missing key errors, not a manifest list mismatch. Option C is wrong because registry authentication failures produce errors like 'unauthorized: authentication required' or 'denied: requested access to the resource is denied', not a manifest architecture mismatch.

Why this answer

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because modifying the role's defaults/main.yml directly changes the role, which violates the requirement to not modify the role. Option C is wrong because renaming the playbook variable from `lib_version` to `libapp_version` does not address the issue; the role's task uses `libapp_version`, and simply renaming the variable in the playbook's vars section would still leave `libapp_version` undefined unless the variable is explicitly set. Option D is wrong because creating a file roles/web/vars/main.yml modifies the role's internal structure, which is not allowed per the requirement to not modify the role.

Why this answer

How to eliminate wrong answers

Option B (Module) is wrong because modules are used to perform actions on remote hosts (e.g., install packages, manage services), not to fetch data from external APIs for use in variables. Option C (Action plugin) is wrong because action plugins execute on the controller and are typically used to implement complex module behavior or conditional logic, not for simple data retrieval like a lookup. Option D (Filter plugin) is wrong because filter plugins transform data within Jinja2 templates (e.g., format strings, manipulate lists), not fetch data from external sources.

Why this answer

How to eliminate wrong answers

Option B is wrong because a vault credential is used to store encrypted secrets (like passwords) that are decrypted at runtime, but it does not directly supply the become password to the 'become' mechanism; the become password must be explicitly provided in the machine credential or via a separate credential type. Option C is wrong because Tower does not support assigning two separate machine credentials to a single job template; you can assign multiple credentials of different types, but for SSH and become passwords, both must reside in the same machine credential. Option D is wrong because storing the become password in inventory variables is insecure and not the intended method; Tower expects the become password to be defined in the credential, not in inventory, and using variables would bypass credential management and auditing.

Why this answer

How to eliminate wrong answers

Option B is wrong because vault-encrypting the variable in the playbook only protects the data at rest; when the playbook runs, Ansible decrypts it and the plaintext value can still appear in job output unless `no_log` is also used. Option C is wrong because while injecting the token as an environment variable via a custom credential type is a secure practice, the question states the token is already stored as an extra variable; the correct action to secure the existing setup is to use `no_log`, not to redesign the credential type. Option D is wrong because storing the token in a file with 600 permissions and using `lookup` does not prevent the token from being displayed in job output; the `lookup` plugin reads the file and the value can still be logged unless `no_log` is applied.

Why this answer

How to eliminate wrong answers

Option A is wrong because Ansible Automation Platform 2.4 supports both local and remote PostgreSQL databases; the setup script allows specifying a remote database host. Option B is wrong because a password mismatch would produce an authentication error (e.g., 'password authentication failed'), not a connection timeout or 'could not connect to server' error. Option C is wrong because SELinux blocking would typically manifest as a permission denied error on socket files or port access, not a generic connection failure to the database server; also, the error message does not reference SELinux denials.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `split(',')` on a string like '192.168.2.1/24' would produce a list with one element, but the conditional logic is flawed: it uses `item.secondary_ips | default([]) | split(',')` which fails when `secondary_ips` is undefined (default returns an empty list, and `split` on a list causes an error). Option B is wrong because `[item.secondary_ips | default('')] | flatten` wraps a string in a list, but if `secondary_ips` is already a list, it nests it (e.g., `[['192.168.2.1/24']]`), and if undefined, it creates `['']` (a list with an empty string), both of which break the template. Option C is wrong because `| string` converts a list to a string representation (e.g., `['192.168.2.1/24']` becomes `['192.168.2.1/24']` as a string), then `split(',')` splits that string incorrectly, producing malformed IP entries.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'set_fact' module sets variables at runtime within a playbook, not credentials; source control tokens must be stored securely in a credential type, not hardcoded in playbooks. Option B is wrong because Ansible Tower does not support a single credential that combines SSH and source control tokens; credentials are typed (machine, source control, vault, etc.) and cannot be merged. Option C is wrong because extra variables are not designed for sensitive credentials; they are visible in job runs and logs, whereas source control tokens should be stored in a dedicated credential type with encryption.

Why this answer

How to eliminate wrong answers

Option B (include_role) is wrong because it dynamically includes an entire role at runtime, not a set of tasks that conditionally include other task files; it is designed for role reuse, not granular task file inclusion based on per-host variables. Option C (import_role) is wrong because it statically imports a role at playbook parse time, meaning all tasks and dependencies are pre-processed and cannot be conditionally evaluated per host at runtime. Option D (import_tasks) is wrong because it statically imports task files at parse time, so any conditional logic or variable-based inclusion is resolved before the playbook runs, preventing per-host runtime evaluation.

Why this answer

How to eliminate wrong answers

Option A is wrong because network credentials are designed for network device authentication (e.g., SNMP, SSH), not for storing cloud API tokens, and they do not support custom fields for API secrets. Option C is wrong because a single custom credential type for all cloud providers would violate the principle of least privilege, as it would expose all API keys to any job template using that credential, increasing the risk of unauthorized access. Option D is wrong because machine credentials are intended for SSH key-based authentication to managed hosts, not for cloud API secrets, and using an SSH key field for an API secret would be a misuse of the credential type, potentially causing authentication failures.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because setting host_vars for each target host defines variables per host but does not control task execution; tasks will still run on all hosts unless a 'when' condition references those variables. Option B is wrong because group_vars define variables for all hosts in a group, but tasks will execute on every host in that group unless a 'when' condition is added; group_vars alone cannot restrict execution to a subset of hosts within the group. Option D is wrong because tags on a role are used to selectively include or exclude tasks during playbook runs via the '--tags' or '--skip-tags' options, but they do not enforce host-based restrictions; tags control which tasks run globally, not which hosts they run on.

Why this answer

How to eliminate wrong answers

Option A is wrong because `state: disabled` is the correct parameter to mark a backend server as disabled in a load balancer module like `nginx` or `haproxy`; `state: maintenance` is not a valid state in standard Ansible load balancer modules. Option C is wrong because `delegate_to: lb01` is appropriate for running the disable task on the load balancer host; setting it to localhost would run the task on the control node, which would not affect the actual load balancer. Option D is wrong because `serial` is a valid play-level keyword that controls batch size, not a global variable; it is correctly used in the playbook to define rolling update behavior.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because while a lookup plugin to fetch from a secrets manager is a valid approach, the question specifies a 'shared repository' (e.g., Git), not an external secrets management service; the recommended approach for repository-based storage is ansible-vault. Option C is wrong because storing the password in an environment variable on the controller is insecure—environment variables can be leaked via process listings, logs, or debugging tools, and they are not encrypted at rest. Option D is wrong because hardcoding the password in the playbook and using .gitignore does not prevent the password from being visible in the playbook file itself, and .gitignore only prevents accidental commits, not exposure to anyone with access to the file system.

Why this answer

How to eliminate wrong answers

Option B is wrong because the 'python' key under 'dependencies' is used for Python packages (e.g., pip install), not for RPM packages. Option C is wrong because there is no 'prepended_base' directive in execution-environment.yml; the correct way to modify the base image is through the 'base_image' field or by adding dependencies. Option D is wrong because while using a custom base image that includes the RPM is a valid approach, the question specifically asks how to add it in the execution-environment.yml file, and the correct method is to list it under 'dependencies: system' rather than building a separate custom base image.

Why this answer

How to eliminate wrong answers

Option B is wrong because serial: 1 would take down only 1 node at a time, which is safe but less efficient than serial: 2 since it increases the total update time. Option C is wrong because serial: 3 would take down 3 nodes at once, leaving only 2 online, which breaks the quorum requirement of 3 out of 5 nodes. Option D is wrong because serial: 5 would take down all 5 nodes simultaneously, completely breaking quorum and causing the application to fail.

Why this answer

How to eliminate wrong answers

Option B is wrong because the `lineinfile` module is inherently idempotent when used correctly; the issue is not with loops but with the regexp pattern failing to match. Option C is wrong because `loop` and `with_items` are functionally equivalent in modern Ansible (both are converted to the same internal structure), so switching to `with_items` would not fix the regexp mismatch. Option D is wrong because backreferences are used in `regexp` to capture and reuse parts of the matched line, but the problem here is that the regexp does not match at all due to whitespace; backreferences would not help if the pattern fails to match.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `items2dict` performs the inverse operation, converting a list of key-value pairs back into a dictionary, not converting a dictionary into a list. Option C is wrong because `flatten` is used to reduce nested lists into a single flat list, not to transform dictionaries into key-value pair lists. Option D is wrong because `json_query` is a filter for querying JSON data using JMESPath expressions, not for converting dictionaries to a list of key-value pairs.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the error is about a missing manifest for a specific tag, not an authentication failure; `podman login` would not fix a non-existent tag. Option C is wrong because changing the base image to a different registry (e.g., Docker Hub) is unnecessary and may break compatibility with Red Hat Ansible Automation Platform requirements; the issue is only the tag. Option D is wrong because the container runtime version is irrelevant to a tag lookup failure; the error is purely about the image tag not being found in the registry.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `/usr/share/ansible/collections` is the default location for system-wide (root) collection installations, not for a regular user. Option C is wrong because `/etc/ansible/collections` is not a standard default path for collections; `/etc/ansible/` is typically used for configuration files like `ansible.cfg` and `hosts`, not collections. Option D is wrong because `/opt/ansible/collections` is not a default Ansible collection path; it might be used in custom setups but is not the default for any user level.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if 'become' privilege escalation were not configured, the tasks would fail with a permission error (e.g., 'Permission denied') rather than reporting 'changed=0'. Option B is wrong because running with '--check' would report 'changed=1' for tasks that would make changes, not 'changed=0' for all tasks, and the manual audit would still find the servers non-compliant. Option D is wrong because the Ansible modules used (lineinfile, firewalld, selinux, service) are all core modules included with Ansible Engine/Ansible Core and do not require separate installation on the control node.

Why this answer

How to eliminate wrong answers

Option C is wrong because 'Source control credential' is not a distinct credential type in Ansible Tower; source control authentication is handled by machine or cloud credentials, or via SSH keys stored in a project's settings, not as a separate credential category. Option D is wrong because 'Cloud credential' is not a valid type; Tower uses specific credential types like Amazon Web Services, Google Compute Engine, or Azure, which are sub-types of 'Machine' or 'Network' credentials, not a generic 'Cloud' type.

Why this answer

How to eliminate wrong answers

Option A is wrong because it retains the original whitespace and uppercase 'BANANA', failing to apply the `lower` filter to all elements and the `map('trim')` filter correctly. Option C is wrong because it only trims the second element ('banana') but leaves whitespace on the first and third, indicating a misunderstanding that `map('trim')` applies to all list elements, not just one. Option D is wrong because it uppercases all elements, which is the opposite of the `lower` filter's behavior.

Why this answer

How to eliminate wrong answers

Option A is wrong because manually installing each dependency on the control node is error-prone, not scalable, and does not ensure dependencies are available in the execution environment or to other team members. Option C is wrong because including all dependencies directly in the collection's repository violates best practices—collections should declare dependencies in `galaxy.yml` or `requirements.yml`, not bundle them, as this leads to repository bloat and version conflicts. Option D is wrong because `ansible-galaxy collection download` only downloads collections for offline use; uploading them to the private hub does not automatically resolve dependencies from external sources unless those dependencies are also downloaded and uploaded, which is not guaranteed by this approach.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because if the included task file does not exist on the control node, Ansible would produce a 'file not found' or 'could not find or access' error, not a 'template error'. Option C is wrong because file permissions on the control node affect whether Ansible can read the file, but a permissions issue would result in a 'permission denied' error, not a Jinja2 template error. Option D is wrong because a syntax error inside the included tasks would cause a playbook failure when those tasks are parsed or executed, but the error message would be a YAML or Ansible syntax error, not a 'template error' from the include path resolution.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'forks' parameter controls the number of parallel tasks within a single playbook run, not the number of concurrent jobs across the controller. Option B is wrong because the 'allow simultaneous' option in a job template permits multiple runs of the same template at once, but it does not limit overall node concurrency. Option C is wrong because the number of execution environments affects the runtime environment for jobs, not the concurrency limit on a specific node.

Why this answer

How to eliminate wrong answers

Option A is wrong because `throttle: 1` limits the number of concurrent tasks per host or per play, but it does not control the batch size of hosts being updated; it limits task concurrency, not the sequential update of hosts. Option B is wrong because `forks: 1` sets the number of parallel processes Ansible uses to execute tasks on hosts, but it still allows all hosts in the batch to be processed in parallel; it does not enforce a one-at-a-time update across the entire fleet. Option D is wrong because `max_fail_percentage: 0` defines the maximum percentage of hosts that can fail before the playbook aborts, but it does not control the order or batch size of updates; it is a failure threshold, not a sequencing mechanism.

Why this answer

How to eliminate wrong answers

Option B is wrong because `defaults/main.yml` is used to define default variable values for the role, not dependencies. Option C is wrong because `tasks/main.yml` contains the main list of tasks to execute for the role, but it does not support dependency declarations. Option D is wrong because `vars/main.yml` is used to define variables with higher precedence than defaults, but it cannot define role dependencies.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because if the script were not executable, Ansible would fail to run it entirely and would not produce any inventory hosts, not hosts without variables. Option B is wrong because insufficient GCE service account permissions would typically cause the script to fail to retrieve instance data, resulting in an empty inventory or an error, not hosts with missing variables. Option D is wrong because `hosts: all` is a playbook-level directive that targets all inventory hosts, not a cause for missing variables; it does not affect how the dynamic inventory script populates variables.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `ansible-galaxy collection scaffold` is not a valid subcommand; `scaffold` is used for roles, not collections. Option B is wrong because `ansible-galaxy collection create` is not a valid subcommand; the correct verb is `init`. Option C is wrong because `ansible-galaxy collection new` is not a valid subcommand; `new` is used for roles, not collections.

Why this answer

Why this answer