Ansible Automation Certification Exam — Questions and Answers

Question 1: Which Ansible module is best suited for verifying that a deployed configuration file matches the expected checksum before proceeding?

copy
fetch
file
stat (Correct answer)

Correct answer: stat

The `stat` module returns file metadata including md5sum and checksum, allowing playbooks to validate file integrity before continuing.

Question 2: An auditor asks for evidence that configuration baselines have not drifted since last audit. Which Ansible-based approach provides the strongest evidence?

Using ad-hoc commands to check individual settings
Regularly scheduled compliance playbooks with assert tasks that fail and alert on any deviation from baseline (Correct answer)
Keeping playbooks in a local directory without version control
Manually reviewing managed nodes one by one

Correct answer: Regularly scheduled compliance playbooks with assert tasks that fail and alert on any deviation from baseline

Scheduled assert-based playbooks create timestamped, logged evidence of continuous baseline enforcement, which auditors can use to confirm no unreported drift occurred.

Question 3: How is the target hosts' communication with Ansible handled?

SSH (Correct answer)
RDP
Telnet
VNC

Correct answer: SSH

Ansible communicates with its managed nodes (target hosts) primarily over standard SSH (Secure Shell) protocol. This agentless approach means there's no need to install any special software or agents on the target machines, simplifying setup and maintenance. It leverages existing SSH infrastructure for secure and reliable communication.

Question 4: What is the professional standard for handling long-running tasks that may time out on the control node connection?

Split the task into smaller subtasks to avoid timeouts
Use the 'raw' module which ignores timeouts
Increase the SSH timeout indefinitely in ansible.cfg
Use 'async' and 'poll' to run the task asynchronously and check its status separately (Correct answer)

Correct answer: Use 'async' and 'poll' to run the task asynchronously and check its status separately

Async tasks with polling allow Ansible to start a long-running job, release the connection, and check back on completion.

Question 5: Which approach reflects professional competency in managing Ansible Galaxy role dependencies?

Copy role source code directly into the playbook directory
Download roles manually and commit them to the project repository
Define role dependencies in requirements.yml and install them via 'ansible-galaxy install -r requirements.yml' (Correct answer)
Use git submodules for all Galaxy role dependencies

Correct answer: Define role dependencies in requirements.yml and install them via 'ansible-galaxy install -r requirements.yml'

requirements.yml with ansible-galaxy install is the standard, reproducible method for managing external role dependencies.

Question 6: Why is documentation important in Ansible Automation risk management?

It slows down operations
It is optional paperwork
It only benefits legal teams
It creates an audit trail, supports decision-making, and demonstrates due diligence (Correct answer)

Correct answer: It creates an audit trail, supports decision-making, and demonstrates due diligence

This is fundamental to Ansible Automation practice. It creates an audit trail, supports decision-making, and demonstrates due diligence represents the professional standard for risk management in the Ansible Automation certification framework.

Question 7: What professional standard should guide the use of 'become: true' in Ansible tasks?

Apply become in every role's defaults to prevent permission errors
Apply become only to specific tasks that require elevated privileges, following least-privilege principles (Correct answer)
Never use become; use root SSH keys instead
Apply become at the play level to all tasks for simplicity

Correct answer: Apply become only to specific tasks that require elevated privileges, following least-privilege principles

Least-privilege principle dictates that privilege escalation should be scoped as narrowly as possible to reduce security risk.

Question 8: In Ansible automation, what does 'idempotency' mean for technology operations teams?

Tasks execute only once per host regardless of play count
Playbooks can only be run during maintenance windows
Each task must wait for the previous one to complete
Running the same playbook multiple times produces the same result without unintended side effects (Correct answer)

Correct answer: Running the same playbook multiple times produces the same result without unintended side effects

Idempotency means a playbook can be applied repeatedly and will only make changes when the current state differs from the desired state, preventing configuration drift.

Question 9: What does enabling `diff mode` (`--diff`) during a playbook run help assess from a risk management perspective?

It shows exactly what file content will change, enabling review before committing to the change (Correct answer)
It skips tasks with `when` conditions
It speeds up task execution
It disables privilege escalation

Correct answer: It shows exactly what file content will change, enabling review before committing to the change

Diff mode outputs a unified diff of file changes, letting operators review the precise configuration delta and assess its impact before or during a change window.

Question 10: An Ansible inventory file is what?

A file that defines the playbook steps
A file that contains the module definitions
A file that contains the list of target hosts (Correct answer)
A file that contains the variables

Correct answer: A file that contains the list of target hosts

An Ansible inventory file is a plain text file, typically in INI or YAML format, that lists the managed nodes or servers that Ansible will operate on. It organizes these hosts into groups, allowing for targeted execution of playbooks and commands. This file is crucial for defining the infrastructure Ansible will manage.

Question 11: What is the primary purpose of Ansible Vault?

To store playbook execution history for auditing
To manage SSH key rotation across managed hosts
To provide a secure connection tunnel between the control node and managed hosts
To encrypt sensitive data such as passwords, API keys, and certificates within Ansible files (Correct answer)

Correct answer: To encrypt sensitive data such as passwords, API keys, and certificates within Ansible files

Ansible Vault encrypts sensitive content in files or individual strings, allowing secrets to be safely stored in version control.

Question 12: A security team wants Ansible to report compliance drift without making changes first. Which execution mode or module approach supports this?

Using become: false on all tasks
Running playbooks in check mode (--check) or using assert/stat modules in report-only roles (Correct answer)
Disabling handlers in the playbook
Using the raw module for read-only access

Correct answer: Running playbooks in check mode (--check) or using assert/stat modules in report-only roles

Ansible's check mode simulates changes without applying them, and assert/stat-based playbooks can report violations without remediation.

Question 13: When automating patch management with Ansible, which approach ensures minimal downtime for web servers?

Run all patches simultaneously across the fleet
Only patch servers manually after Ansible reports findings
Use serial with load balancer module to drain and patch nodes one at a time (Correct answer)
Patch during peak hours to verify stability

Correct answer: Use serial with load balancer module to drain and patch nodes one at a time

Combining the serial keyword with load balancer modules (like bigip_pool_member) drains traffic from each node before patching, ensuring continuous availability.

Question 14: Which command installs an Ansible collection from Ansible Galaxy?

ansible-collection get namespace.collection
ansible-galaxy install --collection namespace.collection
ansible install collection namespace.collection
ansible-galaxy collection install namespace.collection (Correct answer)

Correct answer: ansible-galaxy collection install namespace.collection

The correct syntax is `ansible-galaxy collection install namespace.collection`, which downloads and installs the specified collection from Galaxy.

Question 15: Which practice best demonstrates professional competency when writing Ansible roles for a team environment?

Embedding all variables directly in tasks for clarity
Avoiding tags so all tasks always run
Following a consistent directory structure and documenting defaults in defaults/main.yml (Correct answer)
Keeping all logic in a single monolithic playbook to reduce files

Correct answer: Following a consistent directory structure and documenting defaults in defaults/main.yml

Using Ansible's standard role directory structure and documenting defaults promotes maintainability and team collaboration.

Question 16: How do continuing education requirements benefit Ansible Automation certified professionals?

They are unnecessary formalities
They reduce practical skills
They only benefit training providers
They ensure professionals stay current with evolving industry practices and knowledge (Correct answer)

Correct answer: They ensure professionals stay current with evolving industry practices and knowledge

This is fundamental to Ansible Automation practice. They ensure professionals stay current with evolving industry practices and knowledge represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 17: How do you pass variables to the role under test in a Molecule converge.yml?

Create a .env file in the molecule/default/ directory
Use molecule.yml's 'provisioner.inventory.vars' section only
Variables must be defined in the role's defaults/main.yml and cannot be overridden in Molecule
Define variables in the 'vars' section of the play in converge.yml, or use a separate molecule/default/group_vars/ directory (Correct answer)

Correct answer: Define variables in the 'vars' section of the play in converge.yml, or use a separate molecule/default/group_vars/ directory

converge.yml is a regular Ansible playbook where you can set variables via 'vars', 'vars_files', or group_vars/host_vars to control role behavior during testing.

Question 18: What does the 'gather_facts: false' setting in a playbook do?

Prevents task output from being displayed
Stops Ansible from connecting to remote hosts
Skips the automatic collection of system information from managed hosts (Correct answer)
Disables variable interpolation

Correct answer: Skips the automatic collection of system information from managed hosts

Setting 'gather_facts: false' disables the implicit 'setup' module call that collects host facts, speeding up playbooks that don't need system information.

Question 19: A professional Ansible practitioner receives a request to automate a process that changes frequently. What design approach best addresses maintainability?

Use shell scripts for frequently changing logic
Write a new playbook for every process variation
Parameterize behavior through variables and roles so changes require only variable updates, not task rewrites (Correct answer)
Hard-code all values in tasks so the logic is explicit

Correct answer: Parameterize behavior through variables and roles so changes require only variable updates, not task rewrites

Parameterization decouples configuration data from automation logic, making playbooks adaptable to change without structural rewrites.

Question 20: What is the risk of disabling SSH host key checking (`ANSIBLE_HOST_KEY_CHECKING=False`) in production?

Ansible cannot gather facts
Privilege escalation is disabled
Vulnerability to man-in-the-middle attacks (Correct answer)
Slower playbook execution

Correct answer: Vulnerability to man-in-the-middle attacks

Disabling host key checking removes verification of remote host identity, making connections susceptible to MITM attacks.

Question 21: In a CI/CD pipeline, at which stage should `ansible-lint` typically run?

Only when a deployment fails
Before the playbook is executed, in the static analysis stage (Correct answer)
During the Molecule converge phase
After production deployment

Correct answer: Before the playbook is executed, in the static analysis stage

Running `ansible-lint` in the static analysis (pre-execution) stage catches code quality issues before any infrastructure is touched.

Question 22: What is the Ansible inventory file's default location?

/etc/ansible/hosts (Correct answer)
/etc/ansible/inventory
/etc/ansible/inventory.ini
/etc/ansible/hosts.ini

Correct answer: /etc/ansible/hosts

By default, Ansible looks for its inventory file at `/etc/ansible/hosts`. This is a standard location for system-wide configuration files on Linux systems. Users can, however, specify a different inventory file using the `-i` flag when running Ansible commands, allowing for flexible project-specific inventories.

Question 23: What is the role of the auto-generated `MANIFEST.json` file inside a built Ansible Collection archive?

It holds license and copyright information for the collection
It specifies which modules are public vs. private within the collection
It contains a file manifest with checksums used to verify collection integrity (Correct answer)
It defines human-readable collection metadata for Galaxy's web UI

Correct answer: It contains a file manifest with checksums used to verify collection integrity

MANIFEST.json is generated automatically by `ansible-galaxy collection build` and contains a list of all included files along with their checksums for integrity verification.

Question 24: Which language is used to write Ansible?

Perl
Ruby
Java
Python (Correct answer)

Correct answer: Python

Ansible is primarily written in Python. This choice of language contributes to its flexibility, extensibility, and ease of integration with other tools and scripts. Its modules and core logic are developed in Python, making it accessible to a broad community of developers.

Question 25: Which tool is commonly used for root cause analysis in Ansible Automation quality management?

Profit analysis
Fishbone (Ishikawa) diagram to identify contributing factors systematically (Correct answer)
Random sampling
Customer surveys only

Correct answer: Fishbone (Ishikawa) diagram to identify contributing factors systematically

This is fundamental to Ansible Automation practice. Fishbone (Ishikawa) diagram to identify contributing factors systematically represents the professional standard for quality in the Ansible Automation certification framework.

Question 26: Which metric best indicates that an Ansible deployment introduced unintended configuration drift across managed nodes?

Number of skipped tasks
Total playbook runtime
Discrepancies revealed by a subsequent `--check` run showing unexpected changes (Correct answer)
Number of handlers notified

Correct answer: Discrepancies revealed by a subsequent `--check` run showing unexpected changes

A follow-up `--check` run against supposedly stable hosts revealing pending changes indicates drift from the desired state caused by the prior deployment.

Question 27: According to Ansible best practices, where should group-specific variables be stored to keep inventory readable?

In host_vars/ directories
In the inventory file inline
In group_vars/ directories (Correct answer)
In the playbook vars block

Correct answer: In group_vars/ directories

The `group_vars/` directory is the recommended location for variables scoped to an inventory group.

Question 28: What is the significance of a code of conduct for Ansible Automation professionals?

It establishes expected behaviors and ethical standards that protect the public and profession (Correct answer)
It applies only to new practitioners
It limits professional freedom
It is merely symbolic

Correct answer: It establishes expected behaviors and ethical standards that protect the public and profession

This is fundamental to Ansible Automation practice. It establishes expected behaviors and ethical standards that protect the public and profession represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 29: What is the role of `uri` module in post-deployment quality assurance?

Generates SSL certificates for web services
Downloads files from remote URLs
Parses JSON API responses into Ansible variables
Sends HTTP requests to verify endpoints are reachable and returning expected responses (Correct answer)

Correct answer: Sends HTTP requests to verify endpoints are reachable and returning expected responses

The `uri` module can make HTTP/HTTPS requests and assert on status codes, response bodies, or headers to confirm a web service is healthy.

Question 30: An Ansible module is what?

A script that runs on the target host
A collection of tasks
A pre-defined set of variables
A function that performs a specific task (Correct answer)

Correct answer: A function that performs a specific task

An Ansible module is a discrete unit of code that performs a specific task on managed nodes. These modules are the building blocks of Ansible playbooks, providing the actual functionality for automation, such as installing packages, managing services, copying files, or executing commands. Each module is designed to be idempotent, meaning it can be run multiple times without causing unintended changes.

Question 31: What does the 'no_log: true' directive do in an Ansible task?

It disables system logging on the managed host for the duration of the task
It prevents the task from writing to syslog on the control node
It suppresses all output including errors and failures
It prevents task arguments and output from being logged to stdout and Ansible log files, protecting sensitive data (Correct answer)

Correct answer: It prevents task arguments and output from being logged to stdout and Ansible log files, protecting sensitive data

'no_log: true' prevents sensitive task parameters (like passwords) from appearing in Ansible's verbose output and log files.

Question 32: A professional engineer wants to validate a playbook syntax without executing it. Which command should they use?

ansible-playbook site.yml --syntax-check (Correct answer)
ansible-playbook site.yml --validate
ansible-playbook site.yml --dry-run
ansible site.yml --check-syntax

Correct answer: ansible-playbook site.yml --syntax-check

--syntax-check parses the playbook and reports YAML and Ansible syntax errors without connecting to or modifying any hosts.

Question 33: What is the primary competency framework for Ansible Automation professionals?

Self-assessed capabilities only
Structured competency standards defined by the certifying body (Correct answer)
Employer-specific requirements only
Ad-hoc skill development

Correct answer: Structured competency standards defined by the certifying body

This is fundamental to Ansible Automation practice. Structured competency standards defined by the certifying body represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 34: A professional Ansible engineer is asked to enforce consistent code style across a large team. Which tool combination is the industry standard?

Manual peer review only
Running playbooks in check mode as the primary style check
Using shellcheck on all Ansible files
ansible-lint for rule enforcement combined with yamllint for YAML formatting, integrated into CI/CD pipelines (Correct answer)

Correct answer: ansible-lint for rule enforcement combined with yamllint for YAML formatting, integrated into CI/CD pipelines

ansible-lint and yamllint together enforce Ansible-specific best practices and YAML formatting, and integrating them in CI ensures consistent standards across contributors.

Question 35: What role does peer review play in Ansible Automation practice?

It provides quality assurance and professional development through collegial evaluation (Correct answer)
It replaces formal certification
It creates unnecessary competition
It is only for beginners

Correct answer: It provides quality assurance and professional development through collegial evaluation

This is fundamental to Ansible Automation practice. It provides quality assurance and professional development through collegial evaluation represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 36: What does the Ansible playbook serve as?

To install the Ansible tool
To manage the Docker containers
To write Python code for automation
To define the configuration and deployment steps (Correct answer)

Correct answer: To define the configuration and deployment steps

An Ansible playbook is a YAML-formatted file that defines a set of tasks to be executed on managed hosts. It serves as the blueprint for automation, describing the desired state of a system, specifying configurations to apply, packages to install, services to manage, and other deployment steps. Playbooks are central to Ansible's functionality.

Question 37: What does the 'ask_variables_on_launch' setting on a Tower Job Template enable?

It requires all variables to be defined in the Tower UI before the job can run
It prompts for all playbook variables automatically with no configuration
It displays all current variable values for review before launch
It allows operators launching the job to provide extra variables at launch time through the UI or API without a survey (Correct answer)

Correct answer: It allows operators launching the job to provide extra variables at launch time through the UI or API without a survey

Enabling 'ask_variables_on_launch' presents a text box in the Tower UI where operators can provide ad-hoc extra variables in YAML/JSON format at launch time.

Question 38: Which approach best describes Ansible's agentless architecture advantage in enterprise digital environments?

No software installation required on managed nodes — only SSH and Python are needed (Correct answer)
Agents are deployed via the ansible-agent package from Galaxy
Managed nodes pull configuration from a central server on a schedule
A lightweight agent under 1MB is installed automatically on first run

Correct answer: No software installation required on managed nodes — only SSH and Python are needed

Ansible's agentless design means only an SSH connection and Python interpreter are required on managed nodes, eliminating agent installation, updates, and security patching overhead.

Question 39: Describe Ansible.

A database management tool
A tool for containerization
A tool for configuration management (Correct answer)
A programming language

Correct answer: A tool for configuration management

Ansible is an open-source automation engine designed for configuration management, application deployment, and task automation. It helps manage and configure computer systems, deploy software, and orchestrate more advanced IT tasks across multiple machines. It is not primarily a containerization tool, database tool, or programming language itself.

Question 40: An Ansible playbook modifies firewall rules on 200 servers using `serial: 1`. What risk does this mitigate compared to running all hosts simultaneously?

Prevents SSH key rotation
Avoids the need for `become`
Speeds up playbook execution
Limits simultaneous outages to one host if the firewall rule locks out management access (Correct answer)

Correct answer: Limits simultaneous outages to one host if the firewall rule locks out management access

Running one host at a time means a bad firewall rule only locks out one server at a time, leaving the rest accessible for remediation.

Question 41: Which ansible.cfg setting disables SSH host key checking?

host_key_checking = False (Correct answer)
check_host_keys = no
ssh_strict = False
verify_host_keys = disabled

Correct answer: host_key_checking = False

Setting host_key_checking = False in ansible.cfg disables SSH known_hosts verification, useful in dynamic environments.

Question 42: What is the professional approach to handling secrets in Ansible playbooks committed to version control?

Exclude all variable files from version control entirely
Use environment variables only and never reference them in playbooks
Store secrets in group_vars as plaintext for easy access
Use Ansible Vault to encrypt sensitive files before committing (Correct answer)

Correct answer: Use Ansible Vault to encrypt sensitive files before committing

Ansible Vault encrypts sensitive data so secrets can be safely stored in version control alongside playbooks.

Question 43: A stakeholder questions why an Ansible playbook was run against production without a change window. Which governance feature would prevent this in the future?

Removing production from the inventory file until needed
Using AAP scheduling and workflow approvals to enforce change windows and human gates (Correct answer)
Adding a pause task at the beginning of every playbook
Encrypting the playbook so only admins can read it

Correct answer: Using AAP scheduling and workflow approvals to enforce change windows and human gates

AAP workflow templates with approval nodes ensure humans authorize automation before it runs against sensitive environments.

Question 44: What does a professional Ansible engineer do when a task needs to behave differently on RHEL vs. Ubuntu hosts?

Use ansible_os_family or ansible_distribution variables with 'when' conditionals or OS-specific task files (Correct answer)
Use the raw module to avoid OS differences
Write separate playbooks for each OS
Require all hosts to use the same OS before running automation

Correct answer: Use ansible_os_family or ansible_distribution variables with 'when' conditionals or OS-specific task files

Ansible's gathered facts expose OS information that can drive conditional logic, enabling a single role to handle multiple distributions.

Question 45: Which Ansible feature allows marking specific tasks to run only during a change window, reducing unintended changes outside that window?

Handlers
Tags (Correct answer)
Async tasks
Conditionals with `when`

Correct answer: Tags

Tags let operators selectively run or skip specific tasks with `--tags` or `--skip-tags`, enabling controlled execution during defined change windows.

Question 46: A playbook needs to iterate over a list of users and create a home directory for each. Which Ansible construct is most appropriate?

Running the playbook once per user with different -e flags
Using with_items or loop with the user module (Correct answer)
Using the command module with a for loop in bash
Writing a separate task for each user

Correct answer: Using with_items or loop with the user module

loop (or legacy with_items) iterates the user module over each element in the list, creating all home directories in a single task definition.

Question 47: Which practice reduces the risk of accidental production changes when maintaining separate dev and prod inventories?

Storing all inventories in one file
Disabling host key checking globally
Requiring explicit `--limit` to target production hosts (Correct answer)
Using the same playbook for all environments

Correct answer: Requiring explicit `--limit` to target production hosts

Requiring `--limit production` or a separate production inventory file adds a deliberate step that prevents accidental targeting of production systems.

Question 48: How should an Ansible Automation professional handle a situation outside their scope of competency?

Recognize limitations and refer to or consult with appropriate specialists (Correct answer)
Ignore the situation
Decline all unfamiliar work
Attempt it anyway

Correct answer: Recognize limitations and refer to or consult with appropriate specialists

This is fundamental to Ansible Automation practice. Recognize limitations and refer to or consult with appropriate specialists represents the professional standard for professional standards in the Ansible Automation certification framework.

Question 49: Which Ansible module is used to manage Docker containers on remote hosts?

ansible_docker
docker_run
docker_container (Correct answer)
container_manage

Correct answer: docker_container

The docker_container module manages the lifecycle of Docker containers including creating, starting, stopping, and removing them.

Question 50: What risk arises when Ansible variables are defined in multiple locations with overlapping names?

Ansible Vault encryption breaks
Unexpected variable precedence may override intended values (Correct answer)
Playbooks will fail to parse
Inventory becomes unsortable

Correct answer: Unexpected variable precedence may override intended values

Ansible's 22-level variable precedence means a lower-priority definition can silently be overridden by a higher-priority one, causing unintended behavior.

Question 51: Which Ansible construct is most appropriate for enforcing a rollback if a deployment task fails?

when clause
block/rescue/always (Correct answer)
loop
tags

Correct answer: block/rescue/always

The `block/rescue/always` structure allows defining tasks that execute only on failure (rescue) or unconditionally (always), enabling structured rollback logic.

Ansible Automation Certification Exam

The Ansible Automation Certification Exam tests knowledge of Ansible playbooks, automation professional standards, risk assessment, and configuration management for IT automation using Red Hat Ansible.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds