Ansible Automation Certification Exam — Questions and Answers

Question 1: A professional Ansible practitioner discovers that a playbook works but produces unnecessary 'changed' results on every run. What should they do?

Refactor tasks to be truly idempotent, using appropriate modules and conditions (Correct answer)
Accept it as normal Ansible behavior
Add 'ignore_errors: true' to suppress the changed status
Mark all tasks with 'changed_when: false'

Correct answer: Refactor tasks to be truly idempotent, using appropriate modules and conditions

Unnecessary changed results obscure real changes and indicate tasks are not properly idempotent, which should be fixed by refactoring.

Question 2: A stakeholder asks why Ansible playbooks sometimes run tasks in a different order than expected. What is the most accurate explanation to give?

Ansible runs tasks in parallel by default to maximize speed
Task order depends on the inventory file structure
Ansible randomizes task order for security
Ansible executes tasks sequentially in the order they appear in the playbook (Correct answer)

Correct answer: Ansible executes tasks sequentially in the order they appear in the playbook

Ansible runs tasks sequentially from top to bottom within a playbook, ensuring predictable execution order.

Question 3: According to Ansible best practices, how should playbook task names be written?

Use only the module name as the task name
Write descriptive, action-oriented names that clearly state what each task does (Correct answer)
Task names are optional and should be omitted to keep playbooks short
Use vague names like 'run task' to avoid over-documenting

Correct answer: Write descriptive, action-oriented names that clearly state what each task does

Descriptive task names improve readability, make play output understandable, and serve as inline documentation.

Question 4: What is a 'Project' in Ansible Tower/AWX?

A group of related Job Templates and workflows
A logical collection of Ansible playbooks linked to a source control repository (Git/SVN) that Tower manages and syncs (Correct answer)
A Tower term for an Ansible role collection
A project plan for automation initiatives tracked in Tower

Correct answer: A logical collection of Ansible playbooks linked to a source control repository (Git/SVN) that Tower manages and syncs

Projects connect Tower to source control repositories, enabling Tower to pull the latest playbooks and roles automatically.

Question 5: What is the significance of a code of conduct for Ansible Automation professionals?

It is merely symbolic
It applies only to new practitioners
It establishes expected behaviors and ethical standards that protect the public and profession (Correct answer)
It limits professional freedom

Correct answer: It establishes expected behaviors and ethical standards that protect the public and profession

This is fundamental to Ansible Automation practice. It establishes expected behaviors and ethical standards that protect the public and profession represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 6: Which competency is demonstrated by using 'ansible-lint' before committing a playbook?

Vault password verification
Code quality assurance and adherence to style standards (Correct answer)
Inventory validation
Performance optimization

Correct answer: Code quality assurance and adherence to style standards

ansible-lint checks playbooks against a set of rules and best practices to catch style issues and potential bugs early.

Question 7: A playbook uses `ignore_errors: yes` on every task. What risk does this introduce?

Ansible Vault cannot be used
Silent failures may leave systems in inconsistent states (Correct answer)
Playbooks run faster but use more CPU
Host facts are not gathered

Correct answer: Silent failures may leave systems in inconsistent states

Ignoring all errors means failures are swallowed silently, leaving infrastructure in unknown or broken states without alerting operators.

Question 8: What is Molecule's 'idempotency' test and why is it important?

Molecule verifies that the role produces identical results across different OS versions
Molecule runs the converge playbook twice and fails if any task reports 'changed' on the second run, verifying that the role doesn't make unnecessary changes (Correct answer)
Molecule checks that all role variable names are unique
Molecule tests that the role can be run in parallel without conflicts

Correct answer: Molecule runs the converge playbook twice and fails if any task reports 'changed' on the second run, verifying that the role doesn't make unnecessary changes

The idempotency check enforces a core Ansible principle—a properly written role should only make changes when needed, not on every run.

Question 9: Which Ansible module is used to copy a file from the control node to a managed host?

copy (Correct answer)
transfer
fetch
send

Correct answer: copy

The copy module transfers files from the Ansible control node (or a defined src path) to a destination on the managed host.

Question 10: What risk does using `no_log: true` in a task mitigate?

Privilege escalation risk
Playbook execution failures
Sensitive data exposure in logs (Correct answer)
Network interception risk

Correct answer: Sensitive data exposure in logs

`no_log: true` prevents sensitive values like passwords and tokens from appearing in Ansible output or log files.

Question 11: What role does peer review play in Ansible Automation practice?

It is only for beginners
It creates unnecessary competition
It provides quality assurance and professional development through collegial evaluation (Correct answer)
It replaces formal certification

Correct answer: It provides quality assurance and professional development through collegial evaluation

This is fundamental to Ansible Automation practice. It provides quality assurance and professional development through collegial evaluation represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 12: Which file is Ansible's primary configuration file?

ansible.cfg (Correct answer)
ansible-config.yaml
ansible.ini
ansible.conf

Correct answer: ansible.cfg

ansible.cfg is the primary configuration file Ansible reads for settings like inventory path, remote user, and SSH options.

Question 13: When using Ansible with 'serial' execution (rolling updates), when do handlers run?

After each individual task within each host
At the very end of the entire play after all batches complete
Only on the last host in the last serial batch
At the end of each serial batch, not at the very end of the entire play (Correct answer)

Correct answer: At the end of each serial batch, not at the very end of the entire play

With serial execution, handlers run at the end of each batch (serial group), ensuring rolling restarts happen properly before the next batch begins.

Question 14: How does continuous improvement apply to Ansible Automation quality management?

It involves ongoing incremental enhancements to processes based on data and feedback (Correct answer)
It means constant major changes
It applies only to products
It is a one-time initiative

Correct answer: It involves ongoing incremental enhancements to processes based on data and feedback

This is fundamental to Ansible Automation practice. It involves ongoing incremental enhancements to processes based on data and feedback represents the professional standard for quality in the Ansible Automation certification framework.

Question 15: How do Ansible Automation professionals evaluate research quality?

Research quality cannot be evaluated
By assessing methodology, sample size, peer review status, and relevance to practice (Correct answer)
By publication date only
By the reputation of the author only

Correct answer: By assessing methodology, sample size, peer review status, and relevance to practice

This is fundamental to Ansible Automation practice. By assessing methodology, sample size, peer review status, and relevance to practice represents the professional standard for research in the Ansible Automation certification framework.

Question 16: What does `any_errors_fatal: true` do in a play?

Stops the entire play if any host fails (Correct answer)
Ignores all task errors
Retries failed tasks automatically
Logs errors to a separate file

Correct answer: Stops the entire play if any host fails

`any_errors_fatal: true` causes Ansible to abort the play for all hosts as soon as one host encounters a fatal error.

Question 17: A DevOps team wants to communicate automation status to stakeholders who don't have AAP access. Which integration approach is most practical?

Configure AAP to post job results to a collaboration tool like Slack or Microsoft Teams (Correct answer)
Grant all stakeholders full AAP admin access
Create manual status reports in spreadsheets
Email raw playbook YAML files after each run

Correct answer: Configure AAP to post job results to a collaboration tool like Slack or Microsoft Teams

AAP's notification integrations push job summaries to collaboration tools, giving stakeholders visibility without requiring direct platform access.

Question 18: Why is documentation important in Ansible Automation risk management?

It only benefits legal teams
It slows down operations
It is optional paperwork
It creates an audit trail, supports decision-making, and demonstrates due diligence (Correct answer)

Correct answer: It creates an audit trail, supports decision-making, and demonstrates due diligence

This is fundamental to Ansible Automation practice. It creates an audit trail, supports decision-making, and demonstrates due diligence represents the professional standard for risk management in the Ansible Automation certification framework.

Question 19: What is the purpose of the `any_errors_fatal: true` play-level option?

Ignore all task errors
Abort the entire play if any host fails a task (Correct answer)
Skip handlers when errors occur
Retry failed tasks automatically

Correct answer: Abort the entire play if any host fails a task

`any_errors_fatal: true` causes Ansible to immediately stop the play for all hosts if any single host fails a task.

Question 20: Which language is used to write Ansible?

Ruby
Python (Correct answer)
Perl
Java

Correct answer: Python

Ansible is primarily written in Python. This choice of language contributes to its flexibility, extensibility, and ease of integration with other tools and scripts. Its modules and core logic are developed in Python, making it accessible to a broad community of developers.

Question 21: What is a risk mitigation strategy in Ansible Automation practice?

Ignoring low-probability risks
Implementing controls that reduce the likelihood or impact of identified risks (Correct answer)
Only addressing risks after they occur
Transferring all responsibility

Correct answer: Implementing controls that reduce the likelihood or impact of identified risks

This is fundamental to Ansible Automation practice. Implementing controls that reduce the likelihood or impact of identified risks represents the professional standard for risk management in the Ansible Automation certification framework.

Question 22: What is the primary competency framework for Ansible Automation professionals?

Ad-hoc skill development
Employer-specific requirements only
Self-assessed capabilities only
Structured competency standards defined by the certifying body (Correct answer)

Correct answer: Structured competency standards defined by the certifying body

This is fundamental to Ansible Automation practice. Structured competency standards defined by the certifying body represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 23: A colleague's playbook uses 'shell' module for every task. What is the professional standard recommendation?

Use purpose-built Ansible modules whenever available, falling back to shell only when necessary (Correct answer)
Shell modules are always preferred for flexibility
Replace all shell tasks with raw module instead
Avoid all command execution modules entirely

Correct answer: Use purpose-built Ansible modules whenever available, falling back to shell only when necessary

Ansible's purpose-built modules are idempotent, handle errors consistently, and follow best practices compared to raw shell commands.

Question 24: How do you pass a variable to a role when including it in a playbook?

Through ansible.cfg under [role_vars]
Only via inventory host_vars
Under the role entry using 'vars:' or as key-value pairs inline (Correct answer)
By editing defaults/main.yml directly before running

Correct answer: Under the role entry using 'vars:' or as key-value pairs inline

You can pass role-specific variables inline using key-value pairs or a vars: block under the role entry in the roles list.

Question 25: How do continuing education requirements benefit Ansible Automation certified professionals?

They ensure professionals stay current with evolving industry practices and knowledge (Correct answer)
They are unnecessary formalities
They only benefit training providers
They reduce practical skills

Correct answer: They ensure professionals stay current with evolving industry practices and knowledge

This is fundamental to Ansible Automation practice. They ensure professionals stay current with evolving industry practices and knowledge represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 26: An Ansible control node's private SSH key is stored with permissions 0644. What is the primary risk?

SSH connections will be slower
Ansible will refuse to connect
The key will be rotated automatically
Other users on the system can read the key (Correct answer)

Correct answer: Other users on the system can read the key

World-readable SSH private keys (0644) allow any user on the system to steal the key and impersonate the control node.

Question 27: When did the Hyderabad meetup group for Ansible start?

2015 (Correct answer)
2016
2014
2017

Correct answer: 2015

This question asks for a specific historical detail about a community group. According to the provided correct answer, the Ansible Hyderabad meetup group was established in 2015. These types of questions require specific historical knowledge about the community or project.

Question 28: What is the difference between 'molecule test' and 'molecule converge'?

They are identical commands with different names
'molecule test' checks syntax only; 'molecule converge' applies the role
'molecule test' destroys instances before and after; 'molecule converge' preserves them permanently
'molecule test' runs the full lifecycle (create→converge→verify→destroy) for CI; 'molecule converge' only applies the role for interactive development (Correct answer)

Correct answer: 'molecule test' runs the full lifecycle (create→converge→verify→destroy) for CI; 'molecule converge' only applies the role for interactive development

'molecule test' is for CI pipelines (full ephemeral lifecycle); 'molecule converge' is for development (persistent instances for iteration).

Question 29: During a post-implementation review, stakeholders ask how to verify that Ansible made only the approved changes. Which feature best supports this?

Disabling the changed status in plays
Using only ad-hoc commands instead of playbooks
Ansible Tower survey forms
The --check flag combined with verbose output for dry-run validation (Correct answer)

Correct answer: The --check flag combined with verbose output for dry-run validation

The --check (dry-run) mode combined with -v verbose output shows exactly what Ansible would change without applying changes.

Question 30: What is the professional approach to handling secrets in Ansible playbooks committed to version control?

Use environment variables only and never reference them in playbooks
Store secrets in group_vars as plaintext for easy access
Exclude all variable files from version control entirely
Use Ansible Vault to encrypt sensitive files before committing (Correct answer)

Correct answer: Use Ansible Vault to encrypt sensitive files before committing

Ansible Vault encrypts sensitive data so secrets can be safely stored in version control alongside playbooks.

Question 31: How does Ansible handle network device privilege escalation (enable mode on Cisco IOS)?

Configure 'privilege_mode: enable' in ansible.cfg under [network]
Use 'enable_mode: true' in the task definition
Network devices don't support privilege escalation in Ansible
Set 'ansible_become: true' and 'ansible_become_method: enable' in inventory; ansible_become_password holds the enable password (Correct answer)

Correct answer: Set 'ansible_become: true' and 'ansible_become_method: enable' in inventory; ansible_become_password holds the enable password

Network privilege escalation uses the 'become' system with 'become_method: enable', which sends the 'enable' command and password to enter privileged exec mode.

Question 32: How should an Ansible Automation professional handle a situation outside their scope of competency?

Decline all unfamiliar work
Recognize limitations and refer to or consult with appropriate specialists (Correct answer)
Ignore the situation
Attempt it anyway

Correct answer: Recognize limitations and refer to or consult with appropriate specialists

This is fundamental to Ansible Automation practice. Recognize limitations and refer to or consult with appropriate specialists represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 33: What is the 'verify' phase in Molecule and what are the two main verifier options?

The verify phase checks idempotency; options are 'task-level' and 'play-level'
The verify phase runs the role in check mode; options are 'diff' and 'nodiff'
The verify phase validates the molecule.yml configuration; options are 'strict' and 'lenient'
The verify phase runs post-role assertions to confirm correct configuration; main verifiers are 'ansible' (using Ansible tasks) and 'testinfra' (using Python pytest) (Correct answer)

Correct answer: The verify phase runs post-role assertions to confirm correct configuration; main verifiers are 'ansible' (using Ansible tasks) and 'testinfra' (using Python pytest)

The verify phase tests that the role achieved its intended outcome using either Ansible assertions or Python-based Testinfra tests.

Question 34: What is the first step in risk assessment for Ansible Automation professionals?

Purchasing insurance
Implementing controls immediately
Identifying potential hazards and vulnerabilities in the specific context (Correct answer)
Delegating to others

Correct answer: Identifying potential hazards and vulnerabilities in the specific context

This is fundamental to Ansible Automation practice. Identifying potential hazards and vulnerabilities in the specific context represents the professional standard for risk management in the Ansible Automation certification framework.

Question 35: What is the Ansible inventory file's default location?

/etc/ansible/hosts (Correct answer)
/etc/ansible/hosts.ini
/etc/ansible/inventory.ini
/etc/ansible/inventory

Correct answer: /etc/ansible/hosts

By default, Ansible looks for its inventory file at `/etc/ansible/hosts`. This is a standard location for system-wide configuration files on Linux systems. Users can, however, specify a different inventory file using the `-i` flag when running Ansible commands, allowing for flexible project-specific inventories.

Question 36: Which Ansible module is best suited for verifying that a deployed configuration file matches the expected checksum before proceeding?

stat (Correct answer)
file
fetch
copy

Correct answer: stat

The `stat` module returns file metadata including md5sum and checksum, allowing playbooks to validate file integrity before continuing.

Question 37: What is the effect of setting `strategy: free` in a play?

Only one host runs at a time
Tasks are run in a random order
Hosts wait for every other host before moving to the next task
Each host executes tasks as fast as it can without waiting for others (Correct answer)

Correct answer: Each host executes tasks as fast as it can without waiting for others

The `free` strategy allows each host to proceed through tasks independently at its own pace.

Question 38: Which practice best demonstrates professional competency when writing Ansible roles for a team environment?

Avoiding tags so all tasks always run
Following a consistent directory structure and documenting defaults in defaults/main.yml (Correct answer)
Keeping all logic in a single monolithic playbook to reduce files
Embedding all variables directly in tasks for clarity

Correct answer: Following a consistent directory structure and documenting defaults in defaults/main.yml

Using Ansible's standard role directory structure and documenting defaults promotes maintainability and team collaboration.

Question 39: What does the principle of idempotency require in a professionally written Ansible task?

The task must always report 'changed' to confirm it executed
The task must complete in under one second
The task must not use any variables
Running the task multiple times produces the same result as running it once (Correct answer)

Correct answer: Running the task multiple times produces the same result as running it once

Idempotency ensures that repeated playbook runs do not cause unintended changes when the system is already in the desired state.

Question 40: Describe Ansible.

A programming language
A tool for containerization
A tool for configuration management (Correct answer)
A database management tool

Correct answer: A tool for configuration management

Ansible is an open-source automation engine designed for configuration management, application deployment, and task automation. It helps manage and configure computer systems, deploy software, and orchestrate more advanced IT tasks across multiple machines. It is not primarily a containerization tool, database tool, or programming language itself.

Question 41: What distinguishes a peer-reviewed study in Ansible Automation literature?

It was written by multiple authors
It was published in any format
Independent experts in the field evaluated the methodology and conclusions before publication (Correct answer)
It was published quickly

Correct answer: Independent experts in the field evaluated the methodology and conclusions before publication

This is fundamental to Ansible Automation practice. Independent experts in the field evaluated the methodology and conclusions before publication represents the professional standard for research in the Ansible Automation certification framework.

Question 42: After a major automation initiative, stakeholders request a metrics dashboard showing automation coverage and job success rates. Which tool provides this natively?

The managed nodes' built-in monitoring agents
The Ansible CLI verbose flag
Ansible Automation Platform's Analytics and Reporting dashboards (Correct answer)
A custom Python script parsing log files

Correct answer: Ansible Automation Platform's Analytics and Reporting dashboards

AAP's built-in Analytics feature provides dashboards showing job trends, host counts, automation savings, and success/failure rates over time.

Question 43: How is the target hosts' communication with Ansible handled?

VNC
SSH (Correct answer)
Telnet
RDP

Correct answer: SSH

Ansible communicates with its managed nodes (target hosts) primarily over standard SSH (Secure Shell) protocol. This agentless approach means there's no need to install any special software or agents on the target machines, simplifying setup and maintenance. It leverages existing SSH infrastructure for secure and reliable communication.

Question 44: How do you call a role inside a playbook using the modern recommended syntax?

include_role: name=myrole
use_role: myrole
roles: [myrole] (Correct answer)
apply_role: myrole

Correct answer: roles: [myrole]

The roles: key in a play statically imports roles before any tasks run; it is the standard way to apply roles in a playbook.

Question 45: Which keyword forces a task to run only once regardless of how many hosts are targeted?

run_once (Correct answer)
serial: 1
single_host
delegate_once

Correct answer: run_once

`run_once: true` on a task causes it to execute on only one host in the play, typically the first host.

Question 46: A project team wants to ensure stakeholders can trigger approved Ansible jobs without needing CLI access or playbook knowledge. What AAP feature enables this?

Exposing SSH keys to stakeholders for direct access
Sharing the ansible-playbook command in a wiki
Granting stakeholders read-only inventory access
Survey forms on workflow and job templates that present a user-friendly interface for parameterized job execution (Correct answer)

Correct answer: Survey forms on workflow and job templates that present a user-friendly interface for parameterized job execution

AAP survey forms let stakeholders launch complex automation by filling out simple forms without needing to understand the underlying playbook code.

Question 47: What does the Ansible playbook serve as?

To define the configuration and deployment steps (Correct answer)
To manage the Docker containers
To install the Ansible tool
To write Python code for automation

Correct answer: To define the configuration and deployment steps

An Ansible playbook is a YAML-formatted file that defines a set of tasks to be executed on managed hosts. It serves as the blueprint for automation, describing the desired state of a system, specifying configurations to apply, packages to install, services to manage, and other deployment steps. Playbooks are central to Ansible's functionality.

Question 48: Which strategy best reduces the blast radius when a faulty playbook runs against a large inventory?

Increasing `forks` for faster completion
Running with `--become`
Disabling `gather_facts`
Using `serial` to limit hosts per batch (Correct answer)

Correct answer: Using `serial` to limit hosts per batch

The `serial` keyword limits how many hosts are updated at once, so a failure stops before affecting the entire fleet.

Question 49: Which approach best demonstrates professional competency in Ansible Automation practice?

Following only personal preferences
Relying solely on initial training
Avoiding challenging situations
Integrating continuing education, practical experience, and evidence-based decision making (Correct answer)

Correct answer: Integrating continuing education, practical experience, and evidence-based decision making

This is fundamental to Ansible Automation practice. Integrating continuing education, practical experience, and evidence-based decision making represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 50: An Ansible module is what?

A pre-defined set of variables
A collection of tasks
A script that runs on the target host
A function that performs a specific task (Correct answer)

Correct answer: A function that performs a specific task

An Ansible module is a discrete unit of code that performs a specific task on managed nodes. These modules are the building blocks of Ansible playbooks, providing the actual functionality for automation, such as installing packages, managing services, copying files, or executing commands. Each module is designed to be idempotent, meaning it can be run multiple times without causing unintended changes.

Question 51: An Ansible inventory file is what?

A file that contains the module definitions
A file that defines the playbook steps
A file that contains the list of target hosts (Correct answer)
A file that contains the variables

Correct answer: A file that contains the list of target hosts

An Ansible inventory file is a plain text file, typically in INI or YAML format, that lists the managed nodes or servers that Ansible will operate on. It organizes these hosts into groups, allowing for targeted execution of playbooks and commands. This file is crucial for defining the infrastructure Ansible will manage.

Ansible Automation Certification Exam

The Ansible Automation Certification Exam tests knowledge of Ansible playbooks, automation professional standards, risk assessment, and configuration management for IT automation using Red Hat Ansible.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

redhat.com — Score release, test delivery, renewal, score validity, exam information · verified Oct 2026
docs.redhat.com — Fees, exam format, retake policy · verified Oct 2026