How to Restrict Job Template Execution to Specific Teams for Production and Development Environments
An organization uses automation controller with multiple projects and teams. They want to enforce that only the operations team can run job templates that make changes in production, while the development team can only run job templates that deploy to development environments. Which three components should be configured to achieve this? (Choose three.)
Quick Answer
Define team roles for each job template is correct because in automation controller, job templates are the objects that RBAC actually attaches to - a team is granted a role, such as Execute, directly on the specific job template it is allowed to run, and that grant is what determines whether operations can trigger the production template while development cannot. This is distinct from, but complementary to, controlling which credentials a template uses: as the explanation notes, assigning separate SSH keys or cloud API tokens to the production and development job templates means that even if someone technically had access to launch a template, the credential itself restricts what infrastructure that job can actually reach. Together, team-scoped roles on the templates and environment-specific credentials attached to those templates form two independent layers of the same enforcement goal - one controls who can press run, the other controls what the run is authorized to touch. Scenarios like this one, where you are asked to enforce separation between teams and environments in automation controller, are almost always testing whether you understand that access control is layered across roles, credentials, and sometimes inventories or projects, rather than relying on a single setting to do all the work.
⚠ Common exam trap
Test-takers frequently confuse execution environments (which are runtime containers) with access control mechanisms, or assume workflow templates can dynamically route based on user roles, when in fact RBAC is static and defined per object.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign different credentials to each job template.
Credentials in automation controller (formerly Ansible Tower/AWX) define the authentication context for a job template. By assigning different credentials (e.g., SSH keys or cloud API tokens) to production and development job templates, you can enforce that only the operations team's credentials have access to production infrastructure, while the development team's credentials are restricted to development environments. This is a fundamental access control mechanism that ties authentication directly to job execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign different credentials to each job template.
Why this is correct
Ensures only appropriate credentials are used.
- ✓
Create separate job templates for production and development.
Why this is correct
Allows different permissions for each environment.
- ✓
Define team roles for each job template.
Why this is correct
RBAC on job templates controls who can launch them.
- ✗
Set execution environments to be team-specific.
Why it's wrong here
Execution environments are not tied to teams for access control.
- ✗
Use a workflow template that routes based on user role.
Why it's wrong here
Workflow templates do not route based on user role.
Go deeper
Related to this question
About these practice questions
One of 520 original EX294 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on EX294
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Automation Controller with multiple teams. They want to ensure that team members can only launch job templates that are explicitly assigned to their team. Which configuration approach should be used?
hard- A.Assign each team to an organization and set organization-level permissions
- B.Set 'allow simultaneous' to false on job templates
- C.Use an Identity Provider (IdP) to restrict access
- ✓ D.Create roles and assign them at the job template level using team roles
Why D: Automation Controller (formerly Ansible Tower) uses Role-Based Access Control (RBAC) where roles (e.g., Execute, Admin) can be assigned to teams at the job template level. This ensures that only members of a specific team can launch the job templates explicitly assigned to that team, without affecting other teams or requiring organization-wide permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX294 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX294 exam.