EX294 Manage inventories and credentials Practice Question
An administrator needs to encrypt a sensitive variable file 'secrets.yml' using Ansible Vault so that it can be safely stored in a Git repository. The file should remain encrypted at rest but be automatically decrypted during playbook runs when the vault password is supplied. Which command correctly creates the encrypted file?
⚠ Common exam trap
Candidates often confuse ansible-vault encrypt with create or encrypt_string, which serve different purposes, or using rekey on a plaintext file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ansible-vault encrypt secrets.yml --vault-password-file vault_pass.txt
The ansible-vault encrypt command is the correct tool to encrypt an existing plaintext file. Using --vault-password-file provides the password non-interactively, enabling automation. The resulting file remains encrypted at rest and is decrypted automatically during playbook runs when the same vault password is supplied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ansible-vault rekey secrets.yml --new-vault-password-file newpass.txt
Why it's wrong here
ansible-vault rekey changes the password on an already encrypted file; it does not encrypt a plaintext file. If secrets.yml is not yet encrypted, rekey will fail. This command is used for password rotation, not initial encryption, so it is incorrect for this scenario.
- ✗
ansible-vault create secrets.yml --encrypt-vault-id default
Why it's wrong here
ansible-vault create is used to create a new encrypted file from scratch, opening an editor. It does not encrypt an existing file, and --encrypt-vault-id is not a valid option for create. This command would either fail or create a new file, not encrypt the existing secrets.yml as required.
- ✗
ansible-vault encrypt_string secrets.yml --name secrets
Why it's wrong here
ansible-vault encrypt_string encrypts a single string value, not an entire file. It outputs an inline encrypted variable that can be placed in a playbook or vars file. It does not encrypt the file secrets.yml as a whole, so it does not satisfy the requirement to encrypt the entire variable file.
- ✓
ansible-vault encrypt secrets.yml --vault-password-file vault_pass.txt
Why this is correct
The ansible-vault encrypt command encrypts an existing file in place, and --vault-password-file specifies the file containing the vault password. This produces an encrypted secrets.yml that Ansible can decrypt at runtime when the same password file is provided, meeting the requirement for secure storage and automatic decryption.
Go deeper
Related to this question
About these practice questions
One of 392 original EX294 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Red Hat exam blueprint
This EX294 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX294 exam.