Hard Difficulty Questions

One text field for the token, and inject it as an environment variable.

Why wrong: Does not allow separate inputs for components.

Two fields: username and password, and use a lookup plugin to fetch tenant ID.

Why wrong: Tenant ID is missing from user input; lookup plugin may not be suitable.

Create a single multiline text field where users paste the base64 string.

Why wrong: Not user-friendly; requires base64 encoding knowledge.

Increase the 'retries' parameter for each task.

Why wrong: Retries handle transient failures but do not extend the time allowed for a single connection.

Increase the 'forks' value in ansible.cfg to 50.

Why wrong: Forks control the number of parallel connections, not timeout behavior.

Set 'async: 600' and 'poll: 10' in the playbook.

Why wrong: Async/poll is for long-running tasks, not for general connection timeouts.

The SSH private key has incorrect permissions on the controller.

Why wrong: The administrator verified the SSH key is correctly deployed.

The remote user specified in the credential does not have sudo access.

Why wrong: The ping module does not require sudo.

The automation controller is behind a firewall that blocks SSH.

Why wrong: The administrator verified the node is reachable via SSH, so firewall is not blocking.

Use 'strategy: free' to allow hosts to run tasks independently.

Why wrong: The free strategy bypasses the ordered batch control, which can lead to inconsistent states.

Use 'gather_facts: no' to speed up the playbook.

Why wrong: Speeding up does not improve coordination or safety; fact gathering is often needed for conditional logic.

Set 'any_errors_fatal: true' to stop the update on the first failure.

Why wrong: This stops the entire update prematurely, which is not ideal for rolling updates; better to handle failures gracefully.

The base image itself

Why wrong: Could be changed but bindep.txt is the direct method.

requirements.yml

Why wrong: Contains collections, not system packages.

requirements.txt

Why wrong: Contains Python packages.

`system_packages:`

Why wrong: Not a valid directive; system packages are specified under 'dependencies: system:'.

`python_requirements:`

Why wrong: Not a valid directive; Python dependencies are listed under 'dependencies: python:'.

ansible-navigator uses a different Python interpreter.

Why wrong: The Python interpreter is inside the EE container; this does not affect discovery.

The base image is not compatible with the installed collections.

Why wrong: This would cause runtime errors, not failure to find the EE.

The EE was not tagged correctly.

Why wrong: Incorrect tagging would cause issues when referencing, but if it's local, ansible-navigator can find it by ID.

The base image does not have Git installed.

Why wrong: Incorrect. The error occurs during 'adding collections' step, which implies Git is available; otherwise the error would be about missing git command.

The collection's Galaxy namespace conflicts with a collection from Automation Hub.

Why wrong: Incorrect. A namespace conflict would cause a different error, such as duplicate collection.

The 'requirements.yml' file for the internal collection is missing.

Why wrong: Incorrect. The Git collection is specified in execution-environment.yml, not in a separate requirements file.

The private key file path in the inventory does not exist on the controller.

Why wrong: The inventory variable is not used by AAP if a credential is assigned.

The machine credential does not contain an SSH private key.

Why wrong: The admin assigned a credential that uses SSH key authentication, so it must have a key.

The 'ansible_become' variable is missing from the inventory.

Why wrong: Become is not related to authentication failure.

Switch the job template to use an execution environment instead.

Why wrong: This might work but is not the first troubleshooting step; the existing virtual environment should be fixed.

Reassign the job template to the default virtual environment.

Why wrong: This would avoid the issue but not fix it; the custom env should still work.

Verify that the credential associated with the job template is valid.

Why wrong: The error indicates a missing Python module, not authentication.

`map`

Why wrong: Incorrect; map is a filter.

`select`

Why wrong: Incorrect; select is a filter for lists.

{{ groups['webservers'] | symmetric_difference(groups['drain']) }}

Why wrong: symmetric_difference returns elements unique to each list.

{{ groups['webservers'] | intersect(groups['drain']) }}

Why wrong: intersect returns common elements.

{{ groups['webservers'] | union(groups['drain']) }}

Why wrong: union returns all elements from both lists.

An error because 'int' is not a valid filter name.

Why wrong: Incorrect; 'int' is a valid filter.

`['1', '2', '3']` as integers, but stored as strings.

Why wrong: Incorrect; map converts to actual integers.

`['1', '2', '3']`

Why wrong: Incorrect; map('int') converts to integers.

- set_fact: server_list: "{{ server_list | map('combine', {'ports': item.ports | split(',')}) }}" loop: "{{ server_list }}"

Why wrong: fails if ports is already a list because split is a string method.

- set_fact: server_list: "{{ server_list | map('combine', {'ports': [item.ports] | flatten}) }}" loop: "{{ server_list }}"

Why wrong: Wraps existing list in another list, causing nested structure.

- set_fact: server_list: "{{ server_list | map('combine', {'ports': item.ports}) }}" loop: "{{ server_list }}"

Why wrong: Does not normalize; ports remains as is.

It sets the directory for filter plugins but only for the current playbook.

Why wrong: Incorrect; the setting applies globally in ansible.cfg.

It configures the path for lookup plugins, not filter plugins.

Why wrong: Incorrect; it specifically affects filter plugins.

It adds the directory to the default search path for filter plugins.

Why wrong: Incorrect; it replaces the default path.

nodes | regex_search('prod') | sort(True)

Why wrong: regex_search returns a list of matches, but not a filtered list of hostnames.

nodes | map('regex_search', 'prod') | sort(reverse=True)

Why wrong: map returns a list of results after applying regex_search to each, which does not filter.

nodes | reject('match', '.*prod.*') | sort(reverse=True)

Why wrong: reject removes items that match, which is opposite of what is needed.

Module

Why wrong: Modules are used for system state changes, not for fetching secrets.

Action plugin

Why wrong: Action plugins execute on the controller but are not meant for data retrieval from external APIs.

Filter plugin

Why wrong: Filter plugins transform data in Jinja2 expressions, not for external lookups.

Use `with_nested` instead

Why wrong: with_nested is even more resource-intensive.

Use `set_fact` with loops inside the task

Why wrong: Still uses Jinja2 loops; no performance gain.

Use `with_items` with `json_query` instead

Why wrong: json_query may have similar overhead; not a guaranteed improvement.

The inventory source cache timeout is set too high.

Why wrong: Cache timeout affects how long old data is used, but update on launch forces a refresh.

The 'update on launch' option is disabled.

Why wrong: The question states it is enabled.

The inventory source is configured as a custom script.

Why wrong: It is an EC2 source.

"fields": [{"id": "password", "type": "string", "label": "Password"}]

Why wrong: Not needed when using SSH key authentication.

"fields": [{"id": "key_type", "type": "string", "label": "Key Type"}]

Why wrong: Unnecessary additional field.