Transform data with filters and plugins practice questions

{{ output | lines | first }}

Why it fails: There is no 'lines' filter in Ansible.

{{ output | first }}

Why it fails: The 'first' filter acts on a list, not a string directly.

{{ output | head(1) }}

Why it fails: There is no 'head' filter in Ansible.

{{ result | json_query('data.users.0.name') }}

Why it fails: Incorrect. Uses `users.0`, which is not valid JMESPath. JMESPath uses bracket notation for indices like `users[0]`.

{{ result.data.users[0].name }}

Why it fails: Incorrect. Native Jinja2 dot notation would work only if `result` were a parsed dictionary of the response body, but the registered variable includes the entire HTTP response object, so `result.data` may not directly access the parsed JSON.

The playbook uses 'hosts: all' but should use 'hosts: webservers'.

Why it fails: The playbook already targets webservers, so this is not the issue.

The script is not executable.

Why it fails: If not executable, Ansible would report an error, not 'no hosts matched'.

The 'ansible_host' variable is not set in hostvars.

Why it fails: Missing ansible_host causes connection issues, but hosts would still be matched.

The debug task uses 'var: myvar' instead of 'msg: "{{ myvar }}"'.

Why it fails: Both are valid; 'var' prints the variable directly without extra quotes.

The playbook uses 'set_fact' with quotes around the variable name.

Why it fails: Quotes around variable name are fine.

The variable contains a fact that is only available on the control node.

Why it fails: Facts are gathered on target hosts, but can be used anywhere.

list

Why it fails: 'list' is not a filter; use 'list' function.

float

Why it fails: There is no 'float' filter; use 'int' or arithmetic.

string

Why it fails: Use 'string' or 'str' but it's not a standard filter; 'string' is a test.

connection

Why it fails: Connection plugins handle transport, not data transformation.

callback

Why it fails: Callback plugins handle output, not data transformation.

The 'changed' key is misspelled as 'change' in the filter.

Why it fails: It's spelled correctly.

The variable 'fw_result' is undefined because the task failed.

Why it fails: If failed, the debug would not run.

The filter 'if' condition is incorrectly evaluating 'fw_result.changed' as a string.

Why it fails: It's a boolean, no issue.

Use 'ignore_errors: yes' on the firewall task and then check the result with 'failed_when' to set a default.

Why it fails: Ignore_errors hides all failures, not just missing facts, and does not set a default port.

Use 'block' and 'rescue' to catch the error and then set the fact.

Why it fails: Block/rescue can work but is more verbose and less efficient than default filter.

Create a separate playbook for servers without the fact file, running a different role.

Why it fails: Too complex and not dynamic; does not handle individual server variations.

{{ '192.168.1.10/28' | ipsubnet }}

Why it fails: The ipsubnet filter performs subnet arithmetic on a CIDR prefix, returning network, netmask or host details for that block; it cannot enumerate individual addresses across an arbitrary start-end range. It is tempting because it does handle IP maths, but it would be correct when deriving subnet boundaries from a given prefix, not for generating a host list.

{{ '192.168.1.10' | ipmath('+10') }}

Why it fails: ipmath performs arithmetic on a single address, returning one derived IP rather than a range, so it cannot enumerate 192.168.1.10 through 192.168.1.20. It is tempting because it manipulates IP addresses, and it would be correct for calculating a specific offset such as a gateway or broadcast address from a host.

{{ '192.168.1.10' | ipwrap }}

Why it fails: ipwrap only brackets IPv6 addresses with square brackets for URL formatting; it returns the same single address unchanged and generates no range. It is tempting because its name suggests IP handling, and it would be correct when embedding an IPv6 literal inside a URL or template string.

{{ data | rejectattr('status', 'equalto', 'inactive') | extract('name') | list }}

Why it fails: Ansible has no extract filter, so this expression fails at runtime despite the rejectattr stage being valid. The extract filter is genuinely used to pull a named key from a dictionary, but not to gather an attribute across a list of dictionaries.

{{ data | selectattr('status != inactive') | map(attribute='name') | list }}

Why it fails: selectattr expects a test name and argument, so 'status != inactive' is parsed as an unknown test and errors. That syntax belongs in a Jinja select or reject expression, which is the correct approach when filtering by a raw comparison rather than a named test.

Use the 'slurp' module to read the /etc/hosts file and check if the server is listed.

Why it fails: The slurp module reads remote file contents into base64, so it verifies only whether a hostname appears in /etc/hosts, not whether the NTP server answers ICMP. It is tempting because slurp is the standard way to fetch a managed node's file for inspection, which would suit auditing hostname mappings rather than testing reachability.

Use the 'wait_for' module with 'host={{ item }}' and 'port=123' to test connectivity, since NTP uses UDP 123.

Why it fails: wait_for tests TCP by default, so port 123 is probed over TCP while NTP listens on UDP; it also cannot perform the ICMP check the scenario now requires. It is tempting because wait_for is the usual module for confirming a service port is accepting connections before dependent tasks run.

Use the 'ping' module with a loop over the ntp_servers list, setting the 'data' parameter to the server IP.

Why it fails: The ping module's data parameter sets the ICMP payload string, not a destination address; the target host comes from the play's host pattern, so looping over ntp_servers would ping the managed node repeatedly. It is tempting because data customises ping output for logging, useful when verifying a single host.

The 'follow_redirects' parameter must be set to 'all' to handle HTTP 4xx and 5xx errors gracefully.

Why it fails: 'follow_redirects' controls whether the uri module follows 3xx Location headers; it has no effect on 4xx or 5xx responses, which are returned directly. Setting it to 'all' is correct when a task must traverse redirect chains, such as an API behind an HTTP-to-HTTPS or load-balancer redirect.

The 'failed_when' condition can inspect the HTTP response before the request is sent.

Why it fails: 'failed_when' is evaluated after the request completes, using the registered result, so it cannot inspect a response that has not yet been sent. It is the right tool when you need custom failure criteria based on returned status codes or body content.

The 'register' keyword automatically parses JSON responses into Ansible variables.

Why it fails: 'register' captures the module's raw result dictionary, including the 'json' key when the response Content-Type is application/json; it does not itself parse anything. Explicit parsing via 'from_json' or the 'json' sub-key is needed when you require structured variables.

set_fact: heading="{{ result.content | regex_replace('<h1>(.*)</h1>', '\1') }}"

Why it fails: Incorrect. The pattern `<h1>(.*)</h1>` only matches the tag and its content, but does not remove surrounding markup; if there is other text, it remains, so the result is not a pure extraction.

set_fact: heading="{{ result.content | regex_search('<h1>(.*)</h1>') }}"

Why it fails: Incorrect. `regex_search` returns the full match (e.g., `<h1>Text</h1>`), not just the inner group.

set_fact: heading="{{ result.content | regex_findall('<h1>(.*)</h1>') | first }}"

Why it fails: regex_findall returns a list of all matches, so piping to first yields only the initial heading and discards the rest; the stem asks for the content inside the h1 tags, which a single extraction cannot supply when multiple headings exist. It tempts because regex_findall is genuinely the filter for pulling every match from a string.

The 'python2-libselinux' package is required because Ansible uses Python 2. Install it with 'dnf install python2-libselinux'.

Why it fails: RHEL 8's Ansible runs under Python 3, and the seboolean module binds through python3-libselinux; installing the Python 2 package provides no binding for the interpreter in use. python2-libselinux would be relevant only on a host still running Ansible under Python 2.

The 'ansible' user lacks sudo access to the 'seboolean' command. Add a sudoers entry to allow it.

Why it fails: Passwordless sudo already grants the ansible user privilege escalation, and the identical sudoers configuration on working hosts rules this out. A sudoers entry would be the fix if failures showed permission-denied errors during privilege escalation rather than an SELinux policy communication error.

The 'libsemanage' package is missing. Install it with 'dnf install libsemanage'.

Why it fails: libsemanage provides the policy-store management API used by semanage, not the Python bindings the seboolean module imports. Missing libsemanage would surface when managing booleans persistently via semanage, not as a libselinux communication failure during a boolean toggle.

user: The component that specifies the process's current working directory.

Why it fails: Incorrect — the current working directory is not part of the SELinux context.

role: The component that defines the hardware architecture.

Why it fails: Incorrect — hardware architecture is unrelated to SELinux contexts.

`split`

Why it fails: Incorrect; split divides a string by a delimiter, not into characters.

`join`

Why it fails: Incorrect; join concatenates list elements into a string.

`map`

Why it fails: Incorrect; map applies a function to each element, not conversion.

It converts the string to uppercase.

Why it fails: Incorrect; that's the `upper` filter.

It returns the string wrapped in double quotes.

Why it fails: Incorrect; it does more than just add quotes; it escapes special characters.

It encodes the string for use in URLs.

Why it fails: Incorrect; that's the `urlencode` filter.

`ssm`

Why it fails: Incorrect; too generic.

`amazon_ssm`

Why it fails: Incorrect; no such lookup plugin.

`ssm_parameter`

Why it fails: Incorrect; not a standard plugin.

An error because password_hash requires the `passlib` library.

Why it fails: Incorrect; password_hash is built-in and does not require extra libraries.

A random alphanumeric string.

Why it fails: The `password_hash('sha512')` filter deterministically returns a crypt-style SHA-512 hash string prefixed with `$6$` and a salt, not random alphanumeric output. Randomness tempts because `password_hash` without a stored salt generates a fresh salt each run, so repeated executions differ — but the result remains a `$6$`-formatted hash, never plain alphanumeric.

The string 'mypassword' unchanged.

Why it fails: The `password_hash` filter always returns a newly computed hash, so the plaintext is never passed through. This distractor tempts because filters like `default` or `b64decode` can return input unchanged when conditions are unmet, but `password_hash` unconditionally hashes. It would be correct only if the filter name implied a no-op fallback, which it does not.

`dict2 | combine(dict1)`

Why it fails: Incorrect: Without recursive=True, combine does a shallow merge, but still the left operand (dict2) is overwritten by dict1, giving precedence to dict1.

`[dict1, dict2] | combine`

Why it fails: Incorrect: This syntax is invalid; the combine filter requires a left operand and an argument.

`dict1 | combine(dict2)`

Why it fails: Incorrect: Here dict1 is the left operand, so dict2 (argument) overwrites dict1, giving dict1's values precedence for overlapping keys, resulting in b=2 instead of 3.