RHCE sample questions with answers

RHCE sample questions

Red Hat Certified Advanced System Administrator in Ansible Exam (EX294), Red Hat.

1. Question 1

   Domain: Perform all tasks expected of a Red Hat Certified System Administrator

   Apache must serve content from the new directory /webdata, but SELinux denies access. The fix must survive a full file system relabel.

   Which commands fix the problem?

   1. chcon -R -t httpd_sys_content_t /webdata, then restart httpd so it re-reads the new labels
   2. setsebool -P httpd_enable_homedirs on
   3. setenforce 0 and set SELINUX=permissive in /etc/selinux/config
   4. semanage fcontext -a -t httpd_sys_content_t '/webdata(/.*)?' then restorecon -Rv /webdata
   Show the answer

   Answer: D. semanage fcontext -a -t httpd_sys_content_t '/webdata(/.*)?' then restorecon -Rv /webdata

   semanage fcontext adds a persistent rule to the policy and restorecon applies it to the existing files. chcon is tempting because it works immediately, but the label is not recorded in the policy and is lost on the next relabel or restorecon.

   Checked against: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/index

2. Question 2

   Domain: Understand core components of Ansible

   Which file in a role holds variables intended to be easily overridden, because they have the lowest precedence of any variable source?

   1. defaults/main.yml
   2. vars/main.yml
   3. meta/main.yml
   4. tasks/defaults.yml
   Show the answer

   Answer: A. defaults/main.yml

   Role defaults sit at the bottom of the precedence order, so inventory, play or extra variables can override them. vars/main.yml is tempting, but role vars have high precedence and are meant for values that should not normally be changed.

   Checked against: https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_reuse_roles.html#role-directory-structure

3. Question 3

   Domain: Configure Ansible

   All hosts in the inventory group datacenter1 must receive the variable ntp_server: ntp1.example.com, without editing the inventory file itself.

   Where should the variable be defined?

   1. host_vars/datacenter1.yml, beside the inventory or the playbook
   2. vars/datacenter1.yml in the project root, loaded automatically
   3. group_vars/datacenter1.yml, beside the inventory or the playbook
   4. The [defaults] section of ansible.cfg
   Show the answer

   Answer: C. group_vars/datacenter1.yml, beside the inventory or the playbook

   Ansible loads group_vars/<groupname> (a file or directory) found next to the inventory or the playbook and applies it to every member of that group. host_vars is tempting because the layout looks the same, but files there are matched against host names, so no host would receive the value.

   Checked against: https://docs.ansible.com/projects/ansible/latest/inventory_guide/intro_inventory.html#organizing-host-and-group-variables

4. Question 4

   Domain: Configure Ansible managed nodes

   The key pair /home/student/.ssh/id_rsa and id_rsa.pub exists on the control node. User devops on every managed host must accept that key.

   Which task achieves this?

   1. ansible.posix.authorized_key with user: devops and key: "{{ lookup('file', '/home/student/.ssh/id_rsa') }}"
   2. ansible.posix.authorized_key with user: devops and key: "{{ lookup('file', '/home/student/.ssh/id_rsa.pub') }}"
   3. ansible.builtin.user with name: devops, generate_ssh_key: true and ssh_key_file: .ssh/id_rsa.pub
   4. ansible.builtin.copy with src: /home/student/.ssh/id_rsa and dest: /home/devops/.ssh/authorized_keys
   Show the answer

   Answer: B. ansible.posix.authorized_key with user: devops and key: "{{ lookup('file', '/home/student/.ssh/id_rsa.pub') }}"

   authorized_key adds a public key to the user's authorized_keys file, and the file lookup reads the .pub file from the control node. The version pointing at id_rsa is tempting because it differs by only four characters, but it would distribute the private key, which is both insecure and useless for authentication.

   Checked against: https://docs.ansible.com/projects/ansible/latest/collections/ansible/posix/authorized_key_module.html

5. Question 5

   Domain: Run playbooks

   site.yml targets hosts: webservers, which contains web1, web2 and web3. You need to re-run it only on web2 after a fix.

   Which command does this without editing the playbook?

   1. ansible-playbook site.yml --limit web2
   2. ansible-playbook site.yml -i web2
   3. ansible-playbook site.yml --hosts web2
   4. ansible-playbook site.yml -e hosts=web2
   Show the answer

   Answer: A. ansible-playbook site.yml --limit web2

   --limit (-l) restricts the run to hosts matching a pattern, intersected with the hosts each play targets. `-e hosts=web2` is tempting, but it only sets a variable, which has no effect unless the play's hosts line uses that variable.

   Checked against: https://docs.ansible.com/projects/ansible/latest/cli/ansible-playbook.html

6. Question 6

   Domain: Perform basic source control operations using Git

   After cloning a repository, what name does git remote -v show for the remote you cloned from?

   1. main
   2. upstream
   3. origin
   4. master
   Show the answer

   Answer: C. origin

   git clone records the source repository as a remote named origin unless you choose another name with --origin. main and master are branch names rather than remote names, and upstream is only a convention some teams add manually.

   Checked against: https://git-scm.com/docs/git-clone

7. Question 7

   Domain: Be familiar with Visual Studio Code (VS Code)

   In the Ansible extension, ansible.validation.enabled is true but ansible.validation.lint.enabled is false because ansible-lint is not installed.

   How are your playbooks validated while you edit?

   1. No validation runs until ansible-lint is installed
   2. The extension falls back to ansible-playbook --syntax-check
   3. The extension runs the playbook in check mode against localhost
   4. The extension runs yamllint with the Ansible profile
   Show the answer

   Answer: B. The extension falls back to ansible-playbook --syntax-check

   The language server documents that when validation is enabled and ansible-lint is disabled, validation falls back to ansible-playbook --syntax-check. Assuming no validation runs is tempting, but only ansible.validation.enabled turns validation off entirely.

   Checked against: https://docs.ansible.com/projects/vscode-ansible/als/settings/

8. Question 8

   Domain: Create Ansible plays and playbooks

   A task runs ansible.builtin.command: whoami with register: result.

   Which task prints just the command's output?

   1. ansible.builtin.debug with var: result.output
   2. ansible.builtin.debug with var: result.msg
   3. ansible.builtin.debug with var: result.stdout_text
   4. ansible.builtin.debug with var: result.stdout
   Show the answer

   Answer: D. ansible.builtin.debug with var: result.stdout

   The command module returns the output in `stdout` (and as a list in `stdout_lines`), along with `rc` and `stderr`. `msg` is tempting because many modules return it, but for command it does not contain the program's output.

   Checked against: https://docs.ansible.com/projects/ansible/latest/reference_appendices/common_return_values.html

9. Question 9

   Domain: Use roles and Ansible Content Collections

   Which command installs the community.general collection into the collections/ directory of the current project?

   1. ansible-galaxy collection install community.general -p collections
   2. ansible-galaxy role install community.general -p collections
   3. ansible-galaxy collection init community.general
   4. dnf install ansible-collection-community-general into ./collections
   Show the answer

   Answer: A. ansible-galaxy collection install community.general -p collections

   `ansible-galaxy collection install` downloads and installs a collection, and -p sets the target path (it is placed under collections/ansible_collections). The role install command is tempting because it takes the same arguments, but it installs roles, not collections.

   Checked against: https://docs.ansible.com/projects/ansible/latest/collections_guide/collections_installing.html

10. Question 10

    Domain: Automate standard RHCSA tasks using Ansible modules

    Which ansible.posix.firewalld argument opens TCP port 8080?

    1. port: 8080
    2. service: 8080/tcp
    3. rich_rule: 8080
    4. port: 8080/tcp
    Show the answer

    Answer: D. port: 8080/tcp

    The port option takes a port or range together with its protocol, in the form 8080/tcp. The bare 8080 is tempting, but firewalld needs the protocol and the module rejects a port without one; `service` expects a predefined service name such as http.

    Checked against: https://docs.ansible.com/projects/ansible/latest/collections/ansible/posix/firewalld_module.html