Ansible Sample Exam for EX407/EX294

379 thoughts on “Ansible Sample Exam for EX407/EX294”

1. Hi @lisenet,

   Thanks for sharing this lab. I’ve used your RHCE lab for my studies and to be honest, in my humble option, your lab was harder than the proper exam itself. So I will use your lab again but this time for my EX407 studies and hopefully when I take the exam I will feel the same, and with a new cert on my belt.

   Thanks once again! :)

   Reply

   • You’re welcome. Good luck with your Ansible exam!

   • Hi! Have you passed the EX407? Was it really easier than this examples?

   • He was referring to EX300 RHCE.

   • I adhere to Jhonatan comments, i used your guide on RHCE, and got my certification. So now onto Ansible with this guide. if it helps on something i did the prep-course on Linux Academy, and this guide is way harder and has more content.
     i just wanted to put my comment to thank you for your amazing work with this site which became my default “go to” when i’m studying any new subject.
     My most sincere thanks to you Tomas.

   • Thank you very much Nick! All the best with your Ansible studies.

2. Hello, Congratulations and thanks for this lab.
   First, I have a question about Task 5.
   How I can use condition with first caracter of userid?
   Thanks very much

   Fred

   Reply

   • Hi, thanks very much! The goal of the sample exam is to test your Ansible skills. If you don’t know how to solve a task, then you need to work with Ansible documentation to find a solution. Good luck!

   • I had a hard time with this one but here is what I used.

     – name: create user for uid for webservers
     user:
     name: “{{item.username}}”
     password: “{{pass_works | password_hash(‘sha512’)}}”
     groups: wheel
     shell: /bin/bash
     ssh_key_file: .ssh/id_rsa
     generate_ssh_key: yes
     ssh_key_bits: 2048
     uid: “{{item.uid}}”
     when: ‘”webservers” in group_names and “12” in item.uid|string’
     loop: “{{users}}”
     – name: create user for uid for database
     user:
     name: “{{item.username}}”
     password: “{{pass_works | password_hash(‘sha512’)}}”
     groups: wheel
     shell: /bin/bash
     ssh_key_file: .ssh/id_rsa
     generate_ssh_key: yes
     ssh_key_bits: 2048
     uid: “{{item.uid}}”
     when: ‘”database” in group_names and “22” in item.uid|string’
     loop: “{{users}}”

   • Without posting a solution, I believe a helpful hint to solve this problem is regex.

   • you can also solve this by using multiple tasks using different hostgroup. so no conditions is needed and no regex is needed.

   • – name: create users WEBSERVERS
     user:
     name: “{{ item.username }}”
     uid: “{{ item.uid }}”
     groups: wheel
     shell: /bin/bash
     password: “{{ user_password|password_hash(‘sha512’, (256*256)|random(seed=inventory_hostname)|string) }}”
     when: “‘webservers’ in group_names and (item.uid|string)[0] == ‘1’”
     with_items:
     – “{{ users }}”

3. Thank you Tomas,

   If you have other examples, don’t hesitate to post here.

   Reply

   • Nice Sample Exam Tomas well done!
     Solved all.

     If someone need a tip for solve some question I can give a hand too! :)

   • I am preparing for Ex407 Ansible exam. Can you please help me on it?

4. Hi Tomas.
   Thanks for useful examples.
   Any tips regarding Task 18?

   Reply

   • Hi Adam, my advise would be to check Ansible documentation. You will find the answer on docs.ansible.com.

   • Tomas
     Solved it with creating role, delegate_to and post_tasks :-)
     I hope that this is one of the proper solutions.

   • Well done!

   • Hello Adam,
     Create role is not necessar for the Task18, just create template with magic variables.
     Thanks

   • For task 18, do we use vim editor and manually create the template file (server_list.j2) beforehand and then create the playbook (server_list.yml) to call the template file (server_list.j2) to create the /etc/server_list.txt on the managed nodes ? or do we create a playbook (server_list.yml) to dynamically create the the template file (server_list.j2) and then call the template file (server_list.j2) to create the /etc/server_list.txt on the managed nodes?

     Thanks.

5. Hi
   Do you have sample questions for high availability clustering exam

   Reply

   • Nope. Clustering is much less popular compared to RHCE or Ansible.

6. Hello Tomas,
   I have a question ?

   What are differences between two conditions:

   when: “‘proxy’ in group_names”
   and
   when: ” {{ inventory_hostname in groups[‘proxy’] }}

   thanks you very much

   Reply

   • The first one looks for a group membership in the array of all the groups the host is in.

     The second one checks if the hostname as configured in Ansible’s inventory host file belongs to a specific group in the inventory.

   • Thanks you very much tomas
     Have a nice day

7. Hello Tomas,

   How much focus I need to give for HA Load Balancing configurations for ansible exam.. i.e. Can I expect the configuration of HA using ansible or NOT ??

   Reply

   • It’s usefull to know, so I’d suggest you to learn how to do it. Anything that falls under the exam objectives can be expected during the exam.

8. hi Tomas ! is it 2.3 or 2.7 version ?

   Reply

   • Neither, it’s generic. Pick any Ansible version that you want to test your skills on.

   • Hey,

     Just to clarify, task 12 that utilises RHEL System Roles would be only on the newer v2.7 exam.
     RHEL System Roles was available from RHEL 7.4 only and the Ansible v2.3 (407k exam) was based on RHEL 7.3 afaik

     Also, in the official RH learning guide for this course in Ansible v2.3 2017, System Roles are not covered at all but they are covered in the latest v2.7 2019 learning guide.

     In other words, if you are doing the 407kv27 exam, definitely learn it, if you are doing the older exam, I guess you are OK to skim it, BUT learn it anyway as it seems Red Hat is going to be pushing more and more official system roles to be released so you will encounter them in the real world.

     PS. Instead of using system roles, for v2.3 play around with modules like wait_for and async/polling as there is an overlap there in terms of end results.

     Love your work by the way Tomas.

   • Yea, you’re right. Ansible v2.3 exam was based on RHEL 7.3, therefore you can skip the system roles question if you want to.

9. Hi Tomas,

   For Task 12, we can use block?

   Thank you

   Reply

   • Sure. The way you solve it is not important as long as you get the desired result.

   • for “Enables httpd_can_network_connect SELinux boolean”, we must use variables or use module?

   • You can use anything that solves the problem for you.

   • —
     – name: First Plays
     hosts: webservers
     tasks:
     – name: block
     block:
     – include_role:
     name: rhel-system-roles.selinux

     rescue:
     – name: debug
     fail:
     when: not selinux_reboot_required

     – name: reboot
     reboot:

     – include_role:
     name: rhel-system-roles.selinux

     AND

     group_vars/webservers.yml:

     selinux_booleans:
     – name: httpd_can_network_connect
     sate: on
     persistent: ‘yes’

   • What’s the reason for using reboot in the playbook?

   • Sorry,

     AND

     group_vars/webservers/webservers.yml:

     selinux_booleans:
     – name: httpd_can_network_connect
     sate: on
     persistent: ‘yes’

   • “Sometimes, the SELinux role must ensure managed hosts are rebooted in order to completely apply its changes. However, it does not ever reboot hosts itselfs. This is so that you can control how the reboot is handled. But it means that it is a little more complicated than usual to properly use this role in a play.
     The way this works is that the role will set a Boolean variable, selinux_reboot_required to true and fail if a reboot is needed’ RedHat

10. Hi, Tomas

    great work, for question 17, I can only think of running the command modile with systemctl set-default multi-user

    but that’s not what you intended to test right? service module seem unable to set the target right?

    Reply

    • Try to avoid the command module in playbooks, because it’s easy to write non-idempotent playbooks this way.

      What happens when you set the default target with a systemctl command? Have a think about it.

    • Hi, Tomas

      Many thanks for the prompt replies, really appreciate it.

      I am aware that the command modules should be avoided. I tried to use the systemd module, surprisingly it didn’t throw any error, but also it didn’t change the default target, have you verify that your target has changed?

      “`
      tasks:
      – name: change target with systemd
      systemd:
      name: multi-user.target
      state: started
      enabled: True
      “`

    • No worries, you’re welcome.

    • Hi, Tomas,

      Managed to think about a more idempotent solution, but still wouldn’t be super excited about it, as this is not really a solution for service.

      “`
      file:
      path: /etc/systemd/system/default.target
      src: /lib/systemd/system/multi-user.target
      state: link
      “`

    • Now you’re getting somewhere!

    • Hi Tomas,
      “What happens when you set the default target with a systemctl command? Have a think about it”:

      systemctl create a symlink?
      maybe it’s preferable to use file module
      Thanks you very much

    • No worries, you’re welcome.

11. Hi Tomas,
    I have question for Task 10:
    “Apache service should be restarted every time the file /var/www/html/index.html is modified.”
    We must use “handlers” after template module?
    Thanks you very much

    Reply

    • You can use handlers to restart a service.

12. thank you tomas, but when i must notify my handlers?
    With my template?
    thank you

    Reply

    • Use Ansile documentation :)

    • – name: template
      template:
      src: “templates/index.html.j2”
      dest: “/var/www/html/index.html”
      notify: restart httpd

    • Well done!

13. thanks you

    I have other question:
    My service will restart only when my template is copied.
    But if my file index.html is modify by others, my handler don’t works.

    Reply

    • That’s expected, because the handler only runs when it’s triggered. If you have a process that modifies the file but does not trigger the handler, then the handler will not run.

    • Thanks you very much Tomas!

14. Curious about questions to relate to updating config files.

    Not about the answer, more about best practices. The simplest solution for updating configs seems to be using replace with regex and lineinfile modules. Is the best practice to use such modules against config files or to use templates that get copied over?

    Reply

    • If you want to update a single line, then using a regex with lineinfile makes sense. If you have multiple lines that need changing, then using a template might be a better option.

15. Hi Tomas,

    For “Task 2: Ad-Hoc Commands”, with whitch user we must run script?
    root ?
    Thanks you

    Reply

    • Create a regular user automation. Use this user for all sample exam tasks.

16. Thanks Tomas for the sample test. I have a question regarding the exam if you can help me out here.

    Will we get access to docs.ansible.com or some form of it during the RedHat exam or only ansible-doc is available?

    Reply

    • Documentation will be provided.

17. Hello Tomas,

    In task 6 , “Each user should have an SSH key uploaded (use the SSH key that you create previously)”,
    I don’t understant; we must use key file of automation user?
    Thanks a lot

    Reply

    • good, i understood, when you say “previously”, we must use ssh keys that we have created during creation of users ( alice…etc)
      thanks

    • Yes, as the question says, use the key that you created previously.

18. My last question for tonight :-)
    How i can push my key between servers?
    I can use rsync?

    Reply

    • You can use ssh-copy-id command.

19. Task 2 , is achieved using adhoc command or playbook or running a script on the destination server ?
    This statement is confusing ”
    Create an SSH keypair. Write a script /home/automation/plays/adhoc that uses Ansible ad-hoc commands to achieve the following:”

    If we have to use adhoc commands then we dont need to create a file.
    I know during the exam we will not be getting any explanation to the question.. it up to the students to analyze and sort out the problem. ( KIOSK Exams )

    Reply

    • You have to write a script that uses ad-hoc commands. I’m sorry, but I don’t see anything confusing about this question.

20. Task 6. Are we supposed to be parsing the first character of uid ? For the life of me I can’t parse it unless I force uid to be a string in the user_list.yml by surrounding the uid’s with double quotes. I could use , etc on the number but that is not what we are looking for either I suppose. Maybe i’m reading into your question too much ?

    Thank you for putting this together it is really making be dig into it and prep for the exam.

    Thanks,
    Phil

    Reply

    • No worries, good luck with your prep!

21. Thank you for this post again, Tomas. I got my certification yesterday on ver. 2.7 and this exercise was extremely helpful. I am glad I found your site :)

    Reply

    • You’re welcome!

22. 2. SSH key (that you generated) is copied to all inventory hosts for the automation user and stored in /home/automation/.ssh/authorized_keys.

    Hi Tomas.
    in this question I must create ssh-key with script adhoc or I can create ssh-keygen before this script?
    Can you show ad-hoc comand for this question please.

    Reply

    • You should create the keypair manually before writing the script.

23. I tried for few hours, i could not find the substring or taking out first charecter from a string in the documentation, either i am dumb or its too much for a non genius to get certified. Giving up :(

    Reply

    • please try – when: “item.uid|string|first == ‘1’”

24. For task 6, I do that:

    —
    – hosts: all
    become: yes

    vars_files:
    – secret.yml
    – user_list.yml

    tasks:
    – name: Creating users
    user:
    name: “{{ item.username }}”
    uid: “{{ item.uid }}”
    password: “{{ user_password | password_hash(‘sha512’) }}”
    shell: /bin/bash
    groups: wheel
    with_items: “{{ users }}”
    when: (( inventory_hostname in groups[‘webservers’] ) and ( “{{ item.uid }}” >= “1000” and “{{ item.uid }}” = “2000” and “{{ item.uid }}” = “1000” and “{{ item.uid }}” = “2000” and “{{ item.uid }}” < "3000" ))

    Reply

25. For task 6, I do that:
    —
    – hosts: all
    become: yes

    vars_files:
    – secret.yml
    – user_list.yml

    tasks:
    – name: Creating users
    user:
    name: “{{ item.username }}”
    uid: “{{ item.uid }}”
    password: “{{ user_password | password_hash(‘sha512’) }}”
    shell: /bin/bash
    groups: wheel
    with_items: “{{ users }}”
    when: (( inventory_hostname in groups[‘webservers’] ) and ( “{{ item.uid }}” >= “1000” and “{{ item.uid }}” = “2000” and “{{ item.uid }}” < "3000" ))

    Reply

    • this when statement also works for me:

      when: inventory_hostname in groups[‘webservers’] and item.uid|string|first == “1”

26. @lisenet for question 18 . I Got some solution but I’m unable o get the full inventory, I’m able to take the inventory of webserver group only if I mention ‘all’, it throws an error.

    this is my templates– and can you tell me how to achieve all server inventory details.

    127.0.0.1 localhost
    ::1 locahost

    {% for host in groups[‘webserver’] %}
    {{ hostvars[host].ansible_default_ipv4.address }} {{ hostvars[host].ansible_facts.hostname }} {{ hostvars[host].ansible_facts.fqdn }}
    {% endfor %}

    Reply

    • $ cat server_list.j2
      {% for host in groups[‘all’] %}
      {{hostvars[host][‘ansible_facts’][‘fqdn’]}}
      {% endfor %}

      $ cat server_list.yml
      —
      – hosts: all
      become: yes
      tasks:
      – name: copy template
      template:
      src: server_list.j2
      dest: /etc/server_list.txt
      mode: ‘0600’
      setype: net_conf_t
      when: inventory_hostname in groups[‘database’]

    • the question says only apply to the database group not all. That’s what i am thinking too. If i set to all, i can easily get the results. Scratching my head for a solution.

    • You can use the when statement that applies to a group as per Eduardo’s example above.

27. Thank you for those awesome questions! lisenet.

    for task 6. I am confused with the following two statements because my understanding is they are not same.

    *Each user should have an SSH key uploaded (use the SSH key that you create previously –if the ssh key is the same one specified in the Task 2, then the user, automation, can ssh into users’s respective servers as their account without passwords.)

    *After running the playbook, users should be able to SSH into their respective servers without passwords. — does it means users can ssh into their respective servers from the control node? then it needs these users exist and have their ssh key generated on the control node.

    Reply

    • You should use the SSH keys that you created previously for task #2.

    • Thanks for your reply. Tomas :-)
      In task 2, it only asks to generate the ssh key for the user, automation. It does not mention to generate the ssh keys for other users on the control node.

      for the task 6, I use two plays in the playbook. the first play to create users and their ssh public key on control node, update known_hosts key for them. the second play to upload their ssh public key to their respective server. so the users can ssh their servers without password from the control node.

    • It does not have to. You can reuse the same SSH keys as many times and on as many users as you want.

      The goal of this sample example is to allow people to test theirs Ansible skills. Whether you write one play or two plays is irrelevant, as long as you solve the task. How you solve it is really up to you, because there is no one right answer.

28. Thank you for the nice information, Tomas
    It is good to know. I never thought different accounts can use the same SSH keys(paired private/public SSH keys) for the SSH passwordless login before. it makes sense. I did a quick test and it works. Thanks again :-)

    Reply

    • You’re welcome! It’s just a keypair, similar to TLS certificates, you can deploy them on multiple servers.

29. First of all, i wanted to thank you for doing an awesome job, i’m planning to take the ansible exam in 5 weeks, i have noticed on the second task, when i try to modify the /usr/sbin/visudo file, it looks like its taking the changes but when you look inside the file, there’s nothing in there. So i ended up creating a file in the file in the /etc/sudoers.d

    Thank!

    Reply

    • You shouldn’t be editing the binary. What you want is /etc/sudoers.

    • Thanks Tomas, awesome job.

      I use to change escalation privileges using /sbin/visudo (CentOS7). Can I keep using it or is there any module to change the escalation privileges?

    • Not sure what you have in mind, because the visudo command is used to edit the sudoers file.

30. Thanks for the work you do for linux,
    Please point me to a reliable study guide for ex407 exam.
    I also have a situation where our remote servers do not permit remote root login via ssh, we use su to elevate from a normal user. My question is how do I su to root when deploying playbook as the ssh key if the support user not root without compromising security.
    thanks

    Reply

    • I used DO407, if you have RHLS, that’s all you need.

      If you want to use su, then take a look at become_method: su.

31. I’ve been using DO407 to study, that also includes a bit of Tower and Vagrant, however, I don’t see these mentioned as an objective on the EX407 exam. Would it be safe to assume they are not covered on the day?

    Reply

    • Hi, Ansible Tower and Vagrant are not part of the latest EX407 objectives.

32. Hello,

    Last week I passed with 300 score, so happy :)

    Reply

    • Well done!

    • Congrats! How relevant did you find these practice questions?

33. You passed exam with these questions? Was it same?

    Reply

    • These aren’t exam questions, it’s a sample exam that I had created before I took EX407.

34. Hi, thank you for the tips, i have some questions:
    1- will this questions help me to pass EX294(RHEL8) exam. cause i heard both exams are basically the same.
    2- in Task10, you said “Apache service should be restarted every time the file /var/www/html/index.html is modified.”
    does this mean whenever i change index.html via the palybook or any change will trigger httpd to be restarted.
    3- how to note this questions to be near the actual exam questions.
    4- The services that appears in the tasks, are limited (for example only httpd and mysql), or we can face other complicated services such as (iscsi…ldap….)

    Thank you in advance.

    Reply

    • The sample questions should help you to get an idea of what the exam might look like. If you can solve them all in less than 3 hours, then you are in a position to book the exam.

      With regards to the #10, the service should be restarted every time the playbook modifies the index file.

      In theory you can expect any service that is covered by official Red Hat training to appear on the exam.

35. Excellent sample test, it definitely played apart in me successfully passing the EX407 exam.

    Reply

36. I don’t see how it’ meant to create ad-hoc script for generating SSH-KEYS on the nodes when you haven’t provisioned the controller’s key?

    Reply

    • As the tasks says, you need to generate an SSH keypair on the control node and then copy the files to all inventory hosts for the automation user.

37. please send ad-hoc answer

    Reply

    • Unfortunatelly no answers to the sample exam questions will be provided.

38. Hi,
    Just wanted to say thank you for putting together this excellent practice exam. Unfortunately for me I discovered it too late (literally a day before my EX294 exam). I did not make it but plan a retake after practicing with this exam and being able to complete it within 3 hours. I literally ran out of time…

    Reply

    • No worries, I’m sure that you’ll smash it the next time!

39. Hi Everyone,

    In my practice lab I am working on below mention scenario,

    1. Create a logical volume (“mylvol1”) of size 1024M on volume group (“myvg1”)
    With Given conditions:
    a. If volume group doesn’t exist, message “Volume Group does not exist” should be displayed.
    b. If there is not enough free space in volume group (“myvg1”), message “Not enough Free Space” should be displayed. And logical volume (“mylvol1”) should be created with 700M size instead of 1024M.

    I am unable to create logic for condition “b”, please guide me.

    Thanks.

    Reply

    • The logic for part b should be something like this:

      Check the disk space of the volume group, if it’s less that the required volume size, then display the message, if it’s greater that the required volume size, then create the volume.

40. Tomas, I am not exaggerating or making up stories here. but the grading in RHCE is really weird. The script that they are running to check your config and output is unimaginable. :) But I am an RHCE now.
    My serious question to you.

    What do you think Ansible exam? you got 300/300. Are they just focus on the result? they dont care about your playbook etc?

    Is this just a result based?

    Reply

    • I think that it’s an interesting yet challenging exam that requires you to know Ansible really well. As with all Red Hat exams, you need to solve problems, and the outcome is what matters the most from my experience.

      There are different ways you can write a playbook that achieves a specific goal (e.g. creates a new partition). The content of such playbook will depend on your experience and familiarity with the tool. As long as your playbook creates a partition, you should receive points for the task.

      It helps if you approach Red Hat exams from a customer’s point of view (pretty much what happens in reality). If a customer asks you to deploy a new website, they expect the end result to be a running website, they don’t care that much whether you use Apache, Nginx or Lighttpd to deliver the solution.

41. Hi Tomas

    I wrote my ex294 and passed thanks to you. Honestly when I first found this page , I found many of the questions challenging, but after some practice it was a breeze . Thanks again

    Reply

    • Good job, congratulations!

42. Hi Tomas,

    For task 5, does it matter if we modify the user_list.yml file? Like so:

    —
    users:
    – username: alice
    uid: 1201
    – username: vincent
    uid: 1202
    – username: sandy
    uid: 2201
    – username: patrick
    uid: 2202

    Reply

43. question no.2 “/home/automation/plays/adhoc” a directory?
    do files containing ad hoc commands need to be in a directory?

    Reply

    • If you’re explicitly asked to put ad-hoc commands in a directory then yes, otherwise no.

44. Tip for people stuck on task 9 like I was:
    You need to disable the default mysql module with the below command:
    sudo yum module disable mysql

    See:
    https://dev.mysql.com/doc/mysql-repo-excerpt/8.0/en/linux-installation-yum-repo.html

    Reply

45. Hi,

    For task 11 “Use geerlingguy.haproxy role to load balance request between hosts in the webservers host group”, the value of backend should be set automatically based on the inventory ?

    The var haproxy_backend_servers can be dynamically created ?

    Reply

    • Can someone had a response of this ?
      I tried multiple solution but won’t be able to construct this variable with this structure
      haproxy_backend_servers:
      – name: foo-app
      address: foo-address
      – name: bar-app
      address: bar-address

    • You can do something like this:

          haproxy_backend_servers:
            - name: web1
              address: ansible3.hl.local:80
            - name: web2
              address: ansible4.hl.local:80

46. I would to share my solution for task 6 , thats so hard but I do it :D ! I hope to schedule the exam in january in 2020.

    – hosts: all
    become: true
    vars_files:
    – user_list.yml
    – secret.yml
    tasks:
    – user:
    name: “{{ item.username }}”
    uid: “{{ item.uid }}”
    password: “{{ user_password | password_hash(‘sha512’) }}”
    shell: /bin/bash
    groups: wheel
    with_items: “{{ users }}”
    when:
    – “‘webservers’ in group_names and item.uid|string|first == ‘1’ ”
    – user:
    name: “{{ item.username }}”
    uid: “{{ item.uid }}”
    password: “{{ user_password | password_hash(‘sha512’) }}”
    shell: /bin/bash
    groups: wheel
    with_items: “{{ users }}”
    when:
    – “‘database’ in group_names and item.uid|string|first == ‘2’ “

    Reply

    • Hi,
      Nice one on the item.uid|string|first == ‘1’ !
      I see you’re using ‘with_items: “{{ users }}”’. I’ve seen this in a lot of other playbooks as well and I was wondering what the preferred way is?
      The official RedHat course materials for EX294-8.0 state that since Ansible 2.5, the recommended way to write loops is to use the loop keyword. However, you do need to know the with_items keyword because you can encounter it in older playbooks…
      I’m guessing you should still get a pass if you use the older style, seeing as that it still works.

    • Hi Serge thanks for your tip!

      I’ve revisited the ansible documentation for loop scenarions and yes they recommend use loop than with_items.

      I will force me to write with loop .

      Thanks!

    • you can simplify your playbook by using one task
      —
      – name: ansible playbook task 06
      hosts: all
      vars_files:
      – user_list.yml
      – secret.yml
      become: yes
      tasks:
      – user:
      name: “{{item.username}}”
      uid: “{{item.uid}}”
      password: “{{user_password|password_hash(‘sha512’)}}”
      groups: wheel
      shell: /bin/bash
      loop: “{{users}}”
      when: (ansible_fqdn in groups[‘webservers’] and item.uid|string|first == “1”) or (ansible_fqdn in groups[‘database’] and item.uid|string|first == “2”)

    • Adel – thanks for your simplified playbook using one task

47. So for task 6 is there any reason why my playbook would not be idempotent? Not sure how to ask this without giving the answer away. I’m simply user the user module to loop through the users list provided with appropriate conditionals targeting the UID and the server’s group membership. It works as expected but I always get a changed result when I run it.

    Reply

    • Are you regenerating the password hash every time?

    • I guess? I’m using “password: “{{ user_password | password_hash(‘sha512’) }}” which I guess generates a different hash every time hence the change? Just not sure how else I would do it.

    • Check the module documentation, I’m sure that you’ll find the answer in there!

    • Yup. Correct as usual :)

      Thanks!

    • https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html

48. Hi There

    Sorry for stupid question but Task 1 add user is a manual task am i correcnt?

    Reply

    • It is a manual task.

49. Hi,

    I passed the ex407 and now i want to take the EX294. Is there a difference? Do I need to study extra for the EX294? or can I directly book my exam?

    Reply

    • I didn’t take EX294 so don’t take my word for it, but looking at the exam objectives as well as Red Hat training material they are almost identical. If you studied and passed EX407, you should be able to pass EX294 because the objectives are 95% the same.

50. Task 16 asks us to run the playbook against all hosts but then says to only define a variable for groups proxy and database. This means the playbook would fail against the webservers group as the variable wouldn’t be defined. I’m assuming that the solution here is to implement a conditional on the task to only run when the packages variable is defined? Seems like the obvious fix but wanted to confirm that there’s nothing else I’m missing.

    Thanks!

    Reply

    • Task 16 asks you to run the playbook against all hosts and install packages based on host groups. Whether you decide to use variables or not is completelly up to you.

    • Makes sense. Thanks

      BTW I just passed the ex294 with a 276 in large part due to this site. So thanks for the quality material as usual!

    • Well done, you’re welcome!

51. Hi Tomas,
    Just did my EX294 re-take and passed it with a 279 score. So just wanted to say a big THANK YOU for putting this sample exam together, it has been a great help! In fact more so, in my opinion, than the lab materials offered with the official RH294 course on RHLS….

    If anyone is interested, I will post a terraform plan, an ansible playbook and a few ancillary scripts to easily build, configure and start, stop a lab, on github that you could use to practice this sample exam.

    Requirements are:
    – KVM installed (works on CentOS 8 and Fedora 30)
    – RHEL8 qcow2 image (you can download this if you have a free Red Hat developer account, it’s only 713MB).
    – about 6GB of memory available on your system (I’ve given all VMs 1024MB of memory but you can easily change this)
    – Approx 14GB of free space on root

    Reply

    • No worries, you’re welcome!

    • I need few information on RHCE294 exam, can you assist me

    • You can find RHCE8 exam related info on Red Hat’s website.

52. Thanks sir!
    I am passed in ex407 using your content how base for my studies

    Reply

    • Well done, congratulations!

53. Fabiano, first of all congratulations for the fact, that you’ve managed to pass the EX407 exam. I would like to ask you, if the questions given by Tomas ( Tomas, your sample exam, appears to cover almost 100% of the topics, great job!!! ) were more difficult than the “real” ones and if there was a mandatory bash script creation on the exam?
    Thank you in advance

    Reply

54. Hi
    I prepare for EX294 and i have following question:
    I configure partition on disk with condition, when size is too big for disk, fail, display message.
    I do something like that:
    tasks:
    – name: block for disk
    block:
    – name: check size
    parted:
    device: /dev/vdb
    number: 1
    state: present
    part_end: 1GiB
    register: disk_data
    ignore_errors: yes
    – name: fail size
    fail:
    msg: “{{ disk_data.failed }} ERROR”
    when: disk_rozmiar.failed == 1

    It’s work, but I wonder about when condition.
    In my registered variable key failed it’s only I think for check that size is ok or not.
    This is output from registered variable:
    “msg”: {
    “changed”: true,
    “disk”: {
    “dev”: “/dev/vdb”,
    “logical_block”: 512,
    “model”: “Virtio Block Device”,
    “physical_block”: 512,
    “size”: 2097152.0,
    “table”: “msdos”,
    “unit”: “kib”
    },
    “failed”: false,
    “partitions”: [],
    “script”: “rm 1”
    }

    It’s this condition is properly set, or maybe i’m doing something wrong.
    Regards

    Reply

    • What do you want to achieve here?

    • Hi
      i want achieve, that when a partition size is a bigger than free disk space, then I have error msg in play, and from rescue block tasks are run
      Regards
      Tom

    • OK, what you want to do is to gather disk size info and register it so that you can use it later. Then implement a logical operation where an error message is displayed if the partition size is bigger that the disk size.

      There are several ways you can get disk size info, you can use stat, you can use parted, or you can use Ansible facts.

      Take a look at one of my Ansible playbooks on GitHub.

55. Hello Tomas,

    Quick Question. For the task 12.
    “Uses the selinux RHEL system role”

    Should I install system role using galaxy and use them?

    Reply

    • You can if that solves the problem.

56. Hi Tom,

    Task 2: Can you please clarify how can automation user on control node use ansible adhoc commands to setup itself (automation) on managed hosts when the user itself doesn’t exist there?

    Thank you

    Reply

    • You have root access to all servers.

57. Thank you Tom!

    Task 1: requires privilege escalation disabled by default. With this in place, is the expectation for automation user to be able to run privileged commands on managed hosts without manually using -b | –become ? If this is true then I don’t understand how could that be, please help me understand.

    Reply

    • It means that you need to disable by default. It doesn’t say that you can’t use privilege escallation.

58. Thank you

    I am preparing for EX294 towards RHCE, anyone know if there are more sample exams and any other practice, preparation for EX294?

    thanks for help

    Reply

59. Anybody explain Task-8, how to add gpgkey?

    Reply

    • Take a look at rpm_key.

    • How to check whether kay installed or not.
      Im using rpm_key but it is not showing rpm key under /etc/pki/rpm-gpg

    • You can use rpm to list all GPG keys in your RPM database.

    • Thank you Tomas i got it

60. Hi Tom,

    Task 6: Instruction is not clear to me how the users would be able to ssh to inventory hosts without passwd using the key already created for automation user from (task 2)?

    How would the key from one user allow another user to ssh to a remote server ?

    Thank you

    Reply

    • It’s the same key. It’s like using the same password on multiple accounts.

61. For the sample exam if that’s what needed ….. great. But for my own understanding I still don’t get it.

    Thank you

    Reply

    • When you use ssh-keygen to generate a public/private RSA key pair it does just that – creates a key pair. The key pair can be used with any user on any system. You would normally have a key pair per user account, however, this is not set in stone.

      You can use the same key pair for multiple users if you want to. It’s the same thing as if you were to use identical passwords for different user accounts. I hope this clarifies things for you.

62. Hello Guys,

    While working on my lab, I’m not getting correct idea.

    1. While Creating a logical volume (“mylv1”) of size 1200M on volume group (“myvg1”)

    2. If volume group doesn’t exist with enough space then it should display message “Volume Group does not have enough space” should be displayed.

    3. If there is not enough free space in volume group (“myvg1”), message “Not enough Free Space” should be displayed. And logical volume (“mylv1”) should be created with 600M size instead of 1200M.

    I’m unable to write logic

    Thanks in advance.

    Reply

    • The logic could be something like this:

      1. Check if the volume group exists.
      2. If it does not exist, print an error message.
      3. If it does exist, check the size of the volume group.
      4. If the size is sufficient, proceed with volume creation.
      5. If the size is insufficient, display an error message.

63. Tom,

    Interesting, I will try that

    Thank you !!!!

    Reply

64. Tom,

    Is this website available during exam?
    http://docs.ansible.com/

    Any other ansible docs available during exam?

    Thanks

    Reply

    • I can’t tell you what’s on the exam, but I can tell you that you don’t have Internet access.

65. Anyone know what kind of documentation (other than ansible-doc or man pages) is available in exam?

    Reply

66. Task 8: In the thread above I see rpm_key being suggested. If the read task 8 instructions it does not ask to install the gpg key. My understanding the key will be applied automatically for any package installs from the repo.

    Is it really required to install the key?

    Thanks

    Reply

67. Doubt on Task1 and Task2
    Task1 – says that the user that the adhoc scripts and playbooks should run as automation user
    Task2 – says to create the user automation on all the managed nodes using adhoc script.

    Doesn’t it contradict or am I missing something.
    First task says to run ansible as automation user and second says to make users on managed nodes.

    Reply

    • Task 1 says that you need to configure ansible.cfg to use the automation user. It says nothing about ad-hoc commands. Note that you have root access to all five servers.

      Task 2 asks you to use Ansible ad-hoc commands to create the automation user. Ansible will default to running from your user account. Note that you can use the -u switch to connect as a different user.

    • So Tomas, as I understood TASK2 has to be run as root user and then the subsequent tasks with automation user?

    • Yes, ad-hoc commands can be run as the root user.

68. Hi Tomas, you help me with my RHCE, now I think you can help me with EX407.
    My question to you, is this sample 100%? Whats the reason why you did not cover Tower and Galaxy?
    Thank you

    Reply

    • Ansible Tower is not part of the exam objectives (at least not for Ansible 2.7 which I took). Galaxy is included in the sample exam.

69. Hi Tomas,
    Task two, when I tried to use when condition against uid it won’t recognise it.
    I tired to do it like this when: “{{ users[‘uid’] > 1200 }}”
    i can get the user name using item.username along with with_items
    any clue or advice

    Reply

    • Your goal is to get two users created in the webservers group, and two users in the database group according to the requirements. If you can solve it by using item.username, then it’s totally fine.

70. HI everyone! Happy new year! for task 4 would you use a template with a configured sshd_config file per requirements or would you use lineinfile and execute the playbook in 3 tasks for the sshd_config file modification following with a handler to restart sshd service?

    Reply

    • There is no strict requirement really, as long as you solve the question, it should be fine.

71. Hello everyone, I have a couple of questions regarding the EX294 exam – are all the machines ( the “master” node and all its hosts ) already configured ( I mean IP-s are set, there’s a root user already created ), or we need as in the RHCSA exam, configure the network, default gateway etc? And regarding the scripting task – are we allowed to install “sshpass” in order to facilitate the script execution, or it’s forbidden ( if so, could you guys share a bit of your knowledge, how exactly could we skip the initial “ask password” moment )? Because, I’m struggling to find the way how to fulfill the criteria “use Ansible ad hoc commands to first create the user, then copy the ssh-key and finally put a specific content into the sudoers file / or we can just append the newly created “automation” user to the “wheel” group —> the way that I see the things is : run the script as a root ( hence one have ssh key pair to send to the managed hosts ), then using the -u switch to the Ansible ad hoc commands execute them as the “automation” user / obviously his own ssh-key needs to be created separately before sending it to the hosts).

    Thank you in advance

    Reply

    • I can’t tell you what’s on the exam, but all the info that you’ve been given is sufficient to solve the questions.

72. Hello Tomas,
    First thing,your test questions are challenging and great for studying and practicing!

    For Task 3: Can I use 3 different copy modules and change the content: using variables and use different when: inventory_hostname in groups[‘proxy’], groups[‘webserver’], groups[‘database’] to do this task or am I supposed to use loop to do this?

    Reply

    • Thanks! You can do it either way. There is no one right solution, you can solve the question however you see fit.

73. Thank you very much for these examples
    it helped me a lot passing the exam

    Reply

    • No worries, you are welcome.

74. For Task 18: Is the assumption that the Jinga2 template (server_list.j2) is created ahead of time for the playbook use?

    Reply

    • Please disregard this question. The template file needs to be created on the control node ahead of time and gets pushed out to the managed node when the playbook is run.

75. Hi Tomas,
    For Task 2, any clue what is wrong with this?
    ansible all -m user -a ‘name=automation password={{ ‘devops’ | password_hash(‘sha512’, ‘mysecretsalt’) }}’ -b -u root

    I get error saying:
    “msg”: “The tasks includes an option with an undefined variable. The error was ‘sha512’ is undefined”

    I tried to used the FAQ encrypted password for the user module and it is not working. :(

    Thanks.

    Reply

    • Take a look here: https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/

    • Thanks! That worked.

76. Hi Tomas,

    I have given EX294 exam thrice but got failed all the times. I have got all the outputs in exam but I got 177 in first and 2nd attempt and 145 in 3rd attempt. Whereas I have verified output for all the questions and got the correct output. I am going to write exam on 23rd Feb,2020 again. Can you please suggest me tips to clear this exam, it’s very important for me to clear the exam. Hope I will get response from you ASAP. Thank you!!

    Reply

    • My advise would be to ensure that you don’t run your playbooks with root privileges unless it is required.

    • Tomas – when you say “don’t run your playbooks with root privileges” does that mean don’t become root in the playbook? Seems like just about every task requires the remote_user to become root.

      Thanks for any insight!

    • Yes, that’s what I’d recommend to do.

    • Just to clarity – If user provided to execute the playbooks does not have password-less elevated privilege’s then is it good practice to enable that in the sudoers before running playbooks or use the provided user as is (assuming that they don’t have pwless elev) and enter their pw using the -K and -b option every time a playbook is executed? Or maybe this is nuisance is a non-issue.

77. Hi Tomas!
    Yesterday I have failed my ex407 v2.7 with 96 scores:( I have an official learning subscription and complete do407 course, but the practical part is very poor and not enough. I have seen at one of your posts where you are advised to practice such a lot as you can. Can you please advise what practical lab/materials/tasks do you use to prepare your practical part for this exam?
    Also, I am interested in what differences between v2.3 and 2.7 because both exams are available.
    Thanks for your posts.

    Reply

    • I spent a lot of time writing playbooks for various services (Apache, MySQL, Postfix, HAproxy, FTP, SSH etc) using my homelab. I also converted my Puppet manifests to Ansible playbooks, that helped a lot. Try automating services that you use at work.

      I am aware of the two exam versions, but I don’t really know the differences between v2.3 and v2.7. I took the latter one.

78. Hi Tomas,

    First of all thanks for the effort you made.

    I planning for Ansible exam, next week and I have one question regarding the Task2(creation of “automation” user)
    I am fine with creation of user and pushing the ssh_keys (both with adhoc and playbook).

    My question is does this user by default has privilege to do sudo without password. Or we need to configure them on the managed nodes in the exam.

    I know it is not advisable to edit the visudo file… I am aware alternatively to edit the /etc/sudoers.d and make entry for that user accordingly.

    Just I want to how to tackle this situation . Any idea will be really helpful for the exam.

    Thanks,

    Reply

    • In the sample exam case the automation user does not exist by default. It is therefore up to you how you want to handle it. You can create a user and then configure the system to allow sudo access.

79. Hi, Tomas. Thank you for sharing this sample exam.
    I have a question about it. Is necessary to complete this sample exam in how long to be prepared for the ex407?

    Reply

    • The Ansible exam is 4 hours, therefore you probably want to spend less than that solving the sample exam. I’d aim for 3 hours.

80. Hi Tomas,

    I can’t find the ansible ad-hoc command to copy the key to the servers
    On examination is it possible to use this directly ” ssh-copy-id @” ?

    Reply

    • There is an “authorized_key” module

81. Hi Tomas. Congratulations on passing ex407. Can you tell me which exam you think is harder, your exam example or the ex407?

    Reply

    • I can’t really answer this question I’m afraid because I already know what’s on the exam.

82. Hi Tomas, I have failed 3 times. I am planning to give exam again on Feb 25. Though I got all the output still did not through the exam. In configuration file I gave become_method=su under privilege escalation. Please share some tips to pass the exam.

    Reply

    • I’m sorry to hear that, from my experience, the key to success is practice. Can you solve all sample exam questions in 3 hours?

    • Yes, I am have completed the paper within 3 hrs. Also verified all the Output. I see repos were installed on all the nodes but but got result in that objective as 0. For each and every question I got exact output.

    • Have you verified that the repositories are working and using GPG keys?

    • Yes I have verified,everything was good.

    • Perhaps the name was incorrect or something, there must be a reason why you lost points.

83. Hi Tomas,
    Please any updates on EX294? I am planning to sit the exams but have no sample exams or real materials for preparation apart from Sander Van Vugt classes on oreilly.

    Thank you

    Reply

    • What update are you talking about exactly? The sample example for EX294 is the same as for EX407. They share almost identical exam objectives.

84. Hi Tomas,

    I have just finished TASH 2 (Ad-Hoc Commands). I wanted to send it to you for your feedback. Where can I send it to you?

    Reply

    • Well done. The goal of the sample exam is to allow you to test your skills, since there are many different ways you can solve Ansible tasks, providing feedback on an individual basis isn’t something that I offer I’m afraid.

85. Hi Tomas,
    can I post the solutions I found here?

    Reply

86. Hi Tomas,

    First of all thanks for your effort with sample exam preparation. Good job !

    I have a question regarding Task 2 (ad hoc ). Please correct me if I’m wrong.

    You mentioned that all tasks should be executed with “automation” user. But executing ad hoc command “ansible all -m user -a ‘name=automation state=present’ -u root” under automation user always failed because the user has no access to root ssh keys !

    To workaround this we can add to the addhoc command –ask-pass and provide root password but I suspect that root password is not known in real exam.

    Thanks for explanation

    Reply

    • Task 2 asks you to use Ansible ad-hoc commands to create the automation user (this user does not exist at this point). Ansible will default to running from your user account. Note that you can use the -u switch to connect as a different user, e.g. root. You know the root password in the sample exam scenario (because it’s your VMs), this is sufficient to solve the task.

87. Hello, Can anyone help me with a playbook to check if the managed servers are in timesync with the control node, I have used the timesync role to achieve the sync, however I want to write a task that checks the same conditionally.

    Reply

88. Thank you so much Tomas,

    I have passed the ansible exam and i was practicing your sample paper. It was really helpful.

    Reply

    • Well done, amazing!

89. Does anybody know how many questions are there in RHCE EX294?

    Reply

    • You can expect around 20 questions.

90. Wanna ask about #task 2. So I should create script named adhoc and inside this script I write ad-hoc command. Then I just run something like ‘./adhoc’ ??

    Reply

    • The file name (and the directory) of the script is provided: /home/automation/plays/adhoc.

    • Could I get all answer from the task, just to compare with my answer?

91. Hi Tomas,

    For # task 9, how do I check the Volume group exists using stat (what should be provided in path).

    Reply

    • You can use Ansible facts.

92. Hello Tomas ,
    I can’t perform this task 6: “After running the adhoc script, you should be able to SSH into all inventory hosts using the automation user without password, as well as a run all privileged commands.”
    For example, do I have to copy alice’s public key to the vincent and vincent user to Alice?
    Is there a specific form to do this?
    Or is it simpler than expected?
    I’m wasting a lot of time figuring this out. Could you help me?

    Reply

    • You should use the SSH key that you created previously, see task #2.

93. Hi, Tomas. I would like to say thank you for the ansible sample exam that you have created. It really helps me to pass on the exam.
    Now, I will take the OpenShift Administrator EX280 :)
    Thank you again, man.

    Reply

    • You’re welcome. Well done passing the exam, and good luck with OpenShift!

94. Hi Tomas,
    Could you please clarify something for me?
    The control-node has passwordless access to the inventory hosts(using root). Ansible will run on “automation” user on the control-node. So in order to run adhoc commands with “-u root” ( to create the ‘automation’ user on the inv hosts) , user “automation” needs to connect on inventory hosts on user root. What is the proper way to achieve this?
    1.I reset the root passwords on all inv hosts and use ‘–ask-pass’ on the adhoc command
    2. Or I MANUALLY copy the public key of ‘automation’ user from control-node to the ‘root’ user of each inv hosts? This way the control-node will be able to connect in the end to both users root and automation on every inv host with the same key.

    I am interested in the right way that RedHat would point for this.

    Thanks!

    Reply

    • Yes, the control node has passwordless access to the inventory hosts using the root account. You need to configure that part manually when you set your homelab environment up.

    • Well, both solutions work. Is there a prefered way considering the way RedHat validates this step?
      Thanks for this site and for replying.

    • As long as your solution works, it should not matter.

95. Hi Thomas,

    The last part of task 6 (After running the playbook, users should be able to SSH into their respective servers without passwords.”) , I can be done by logging into the machines and running the “ssh-copy-id” command from one user to another or I have to do it in the users.yml playbook ?

    Thanks

    Reply

96. Hi,

    First off, thanks for this practice exam! Second, i’m doing task 6, i have it working in regards to creating the users on the servers, what i’m struggling to understand is the SSH key, should it be another play using authorized key module to put the key from /home/automation/.ssh/id_rsa.pub on each server in the users home directory? Or am i looking to much into it?

    Reply

    • I used authorized_key module to copy the SSH key and it worked like a magic.

    • I guess everyone is struggling with this.

      can do this part with fetch and authorized_keys to append user’s indiividual key but the question lies in dynamic host lookup

      Simple example , for webservers there are node2 and node3, but alice’s public key in these separate nodes are different how do dynamically get those pub keys and append into the respective server.

      Can someone help?

    • The public key is the same regardless of the node. As per instructions, use the SSH key that you created previously (you were asked to create one key). The task requires you to use that key. Since you only have one key, it is going to be the same for all nodes.

97. Hello
    For ad-hoc command.
    ansible my_command -u root –ask-pass
    Or
    ansible my_command -b
    ?
    Tnx

    Reply

    • Hi Pmtaa,
      In order to achieve Task 2 requirements you need to connect on the “root” user on each inventory host. So you need to use the “-u root” option. Option “-b” is used when you need to elevate privileges – and it is not the case here.

    • Hi, you will want to use the -u option with root as the user as this will run the ansible command as the root user. If you have set your environment up correctly you shouldn’t need the -ask-pass flag, don’t forget these commands are going to be run by a script. The -b flag option will elevate the user that is executing the ansible command to root but the automation user doesn’t have root permissions at this stage.

    • How to setup the environment correctly and not have to use the –ask-pass for root?

      Thanks.

    • Hello,
      How to setup the environment to correctly so the –ask-pass flag is not needed?

      Is this the correct way to setup the environement and not be prompted for the root password when running the adhoc command?
      ansible all -e “ansible_user=root ansible_password=rootpassword” -u root -m user -a “name=ansible password={{ ‘ansible’ | password_hash(‘sha512’, ‘mysecretsalt’) }}”

      Thanks in advance for your help.

98. Hi Tomas,

    For Task 3, I have the below playbook that works fine.

    – name: Replace the existing content of /etc/motd
    hosts: all
    become: true
    become_user: root
    tasks:
    – name: Replace /etc/motd on PROXY host group
    content: ‘Welcome to PROXY’
    dest: /etc/motd
    when: inventory_hostname in groups[‘proxy’]

    – name: Replace /etc/motd on webservers host group
    content: ‘Welcome to webservers’
    dest: /etc/motd
    when: inventory_hostname in groups[‘webservers’]

    – name: Replace /etc/motd on database host group
    content: ‘Welcome to MYSQL server’
    dest: /etc/motd
    when: inventory_hostname in groups[‘database’]

    In the above playbook if I use “when: inventory_hostname = ‘ansible2’ ” instead of “when: inventory_hostname in groups[‘proxy’] it is not working. What is wrong with that?

    Reply

99. Hi Pmtaa,
    In order to achieve Task 2 requirements you need to connect on the “root” user on each inventory host. So you need to use the “-u root” option. Option “-b” is used when you need to elevate privileges – and it is not the case here.

    Reply

100. Hi Tomas,

     For Task 9, I am getting the below error message.

     TASK [sample-mysql : Change mysql root password] *******************************************************************************************************************************************************************************************
     fatal: [serverc]: FAILED! => {“changed”: false, “msg”: “The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required.”}

     I have both python 2.7 and 3.6 installed.
     [[email protected] ~]# yum module list|grep python
     libselinux-python 2.8 common Python 2 bindings for libselinux
     python27 2.7 [d] common [d] Python programming language, version 2.7
     python36 3.6 [d][e] common [d], build Python programming language, version 3.6
     [[email protected] ~]#

     My tasks/main.yml:

     # tasks file for sample-mysql
     – name: Create primary partition
     parted:
     device: /dev/sdb
     number: 1
     label: gpt
     flags: lvm
     part_start: 1MB
     part_end: 800MB
     name: primary
     state: present

     – name: Create volume group
     lvg:
     vg: vg_database
     pvs: /dev/sdb1

     – name: Create logical volume
     lvol:
     vg: vg_database
     lv: lv_mysql
     size: 512m
     state: present

     – name: Create file system
     filesystem:
     fstype: xfs
     dev: /dev/vg_database/lv_mysql

     – name: Mount the file system
     mount:
     path: /mnt/mysql_backups
     src: /dev/vg_database/lv_mysql
     fstype: xfs
     state: present

     – name: Install mysql package
     yum:
     name: mysql-community-server
     state: present

     – name: Configure Firewall
     firewalld:
     port: 3306/tcp
     permanent: yes
     immediate: yes
     state: enabled

     – name: Change mysql root password
     mysql_user:
     name: root
     check_implicit_admin: yes
     login_user: root
     login_password: “{{ database_password }}”
     priv: ‘*.*:ALL’
     state: present

     – name: Start mysql
     service:
     name: mysql
     enabled: yes
     state: started

     – name: Copy my.cnf.j2 template
     template:
     src: my.cnf.j2
     dest: /etc/.my.cnf
     notify:
     – restart mysql

     Reply

     • Have you install pymysql via pip on the hosts?
       pip install pymysql

     • install another package python3-PyMySQL

     • Thanks a lot that fixed the issue. How do I know if mysql is working fine? Below is the output I get when I run the playbook.

       [[email protected] plays]$ ansible-playbook mysql.yml –vault-password-file=vault_key

       PLAY [Main playbook for mysql] *************************************************************************************************************************************************************************************************************

       TASK [Gathering Facts] *********************************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [command] *****************************************************************************************************************************************************************************************************************************
       [WARNING]: Consider using the yum module rather than running ‘yum’. If you need to use command because yum is insufficient you can add ‘warn: false’ to this command task or set ‘command_warnings=False’ in ansible.cfg to get rid of
       this message.

       changed: [serverc]

       TASK [sample-mysql : Create primary partition] *********************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Create volume group] **************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Create logical volume] ************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Create file system] ***************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Mount the file system] ************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Install python3-PyMySQL] **********************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Install mysql package] ************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Configure Firewall] ***************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Start mysql] **********************************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Change mysql root password] *******************************************************************************************************************************************************************************************
       ok: [serverc]

       TASK [sample-mysql : Copy my.cnf.j2 template] **********************************************************************************************************************************************************************************************
       changed: [serverc]

       RUNNING HANDLER [sample-mysql : restart mysql] *********************************************************************************************************************************************************************************************
       changed: [serverc]

       PLAY RECAP *********************************************************************************************************************************************************************************************************************************
       serverc : ok=14 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

       [[email protected] plays]$

     • systemctl status confirms mysql is running. Anything else I can check if mysql is OK?

       [email protected] ~]# systemctl status mysql
       ● mysqld.service – MySQL Community Server
       Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; vendor preset: disabled)
       Active: active (running) since Tue 2020-03-10 07:53:55 EDT; 9min ago
       Process: 12589 ExecStartPost=/usr/bin/mysql-systemd-start post (code=exited, status=0/SUCCESS)
       Process: 12573 ExecStartPre=/usr/bin/mysql-systemd-start pre (code=exited, status=0/SUCCESS)
       Main PID: 12588 (mysqld_safe)
       Tasks: 23 (limit: 17484)
       Memory: 136.8M
       CGroup: /system.slice/mysqld.service
       ├─12588 /bin/sh /usr/bin/mysqld_safe –basedir=/usr
       └─12763 /usr/sbin/mysqld –basedir=/usr –datadir=/var/lib/mysql –plugin-dir=/usr/lib64/mysql/plugin –log-error=/var/log/mysqld.log –pid-file=/var/run/mysqld/mysqld.pid –socket=/var/lib/mysql/mysql.sock

       Mar 10 07:53:52 serverc systemd[1]: Stopped MySQL Community Server.
       Mar 10 07:53:52 serverc systemd[1]: Starting MySQL Community Server…
       Mar 10 07:53:54 serverc mysqld_safe[12588]: 200310 07:53:54 mysqld_safe Logging to ‘/var/log/mysqld.log’.
       Mar 10 07:53:54 serverc mysqld_safe[12588]: 200310 07:53:54 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
       Mar 10 07:53:55 serverc systemd[1]: Started MySQL Community Server.
       [[email protected] ~]#

     • Thanks after I have installed python3-PyMySQL it worked fine.

101. Hi,

     For TASK 11, my playbook worked fine. HAPROXY is running on both the servers. But I am getting the below error when I run “curl” command. Has anyone experienced this issue?

     [[email protected] plays]$ curl http://serverb/
     503 Service Unavailable
     No server is available to handle this request.

     [[email protected] plays]$ curl http://serverd/
     503 Service Unavailable
     No server is available to handle this request.

     [[email protected] plays]$

     [[email protected] ~]# systemctl status haproxy.service
     ● haproxy.service – HAProxy Load Balancer
     Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled; vendor preset: disabled)
     Active: active (running) since Sun 2020-03-08 22:06:03 AEDT; 11h ago
     Process: 6019 ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q (code=exited, status=0/SUCCESS)
     Main PID: 6020 (haproxy)
     Tasks: 2 (limit: 11491)
     Memory: 2.8M
     CGroup: /system.slice/haproxy.service
     ├─6020 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
     └─6022 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid

     Mar 08 22:06:03 serverb systemd[1]: Stopped HAProxy Load Balancer.
     Mar 08 22:06:03 serverb systemd[1]: Starting HAProxy Load Balancer…
     Mar 08 22:06:03 serverb haproxy[6020]: Proxy hafrontend started.
     Mar 08 22:06:03 serverb haproxy[6020]: [WARNING] 067/220603 (6020) : parsing [/etc/haproxy/haproxy.cfg:15] : the ‘contimeout’ directive is now deprecated in favor of ‘timeout connect’, and will not be supported in future versions.
     Mar 08 22:06:03 serverb haproxy[6020]: [WARNING] 067/220603 (6020) : parsing [/etc/haproxy/haproxy.cfg:16] : the ‘clitimeout’ directive is now deprecated in favor of ‘timeout client’, and will not be supported in future versions.
     Mar 08 22:06:03 serverb haproxy[6020]: [WARNING] 067/220603 (6020) : parsing [/etc/haproxy/haproxy.cfg:17] : the ‘srvtimeout’ directive is now deprecated in favor of ‘timeout server’, and will not be supported in future versions.
     Mar 08 22:06:03 serverb haproxy[6020]: Proxy hafrontend started.
     Mar 08 22:06:03 serverb haproxy[6020]: Proxy habackend started.
     Mar 08 22:06:03 serverb haproxy[6020]: Proxy habackend started.
     Mar 08 22:06:03 serverb systemd[1]: Started HAProxy Load Balancer.

     [[email protected] ~]# systemctl status haproxy.service
     ● haproxy.service – HAProxy Load Balancer
     Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled; vendor preset: disabled)
     Active: active (running) since Tue 2020-03-10 05:47:51 EDT; 12h ago
     Process: 7339 ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q (code=exited, status=0/SUCCESS)
     Main PID: 7341 (haproxy)
     Tasks: 2 (limit: 5040)
     Memory: 4.5M
     CGroup: /system.slice/haproxy.service
     ├─7341 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
     └─7343 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid

     Mar 10 05:47:51 serverd systemd[1]: Stopped HAProxy Load Balancer.
     Mar 10 05:47:51 serverd systemd[1]: Starting HAProxy Load Balancer…
     Mar 10 05:47:51 serverd haproxy[7341]: [WARNING] 069/054751 (7341) : parsing [/etc/haproxy/haproxy.cfg:15] : the ‘contimeout’ directive is now deprecated in favor of ‘timeout connect’, and will not be supported in future versions.
     Mar 10 05:47:51 serverd haproxy[7341]: [WARNING] 069/054751 (7341) : parsing [/etc/haproxy/haproxy.cfg:16] : the ‘clitimeout’ directive is now deprecated in favor of ‘timeout client’, and will not be supported in future versions.
     Mar 10 05:47:51 serverd haproxy[7341]: [WARNING] 069/054751 (7341) : parsing [/etc/haproxy/haproxy.cfg:17] : the ‘srvtimeout’ directive is now deprecated in favor of ‘timeout server’, and will not be supported in future versions.
     Mar 10 05:47:51 serverd haproxy[7341]: Proxy hafrontend started.
     Mar 10 05:47:51 serverd haproxy[7341]: Proxy hafrontend started.
     Mar 10 05:47:51 serverd haproxy[7341]: Proxy habackend started.
     Mar 10 05:47:51 serverd haproxy[7341]: Proxy habackend started.
     Mar 10 05:47:51 serverd systemd[1]: Started HAProxy Load Balancer.

     Reply

102. Hei Tomas , everybody,

     Thanks Tomas for this sample exam. You have no idea how much it helped …or..you do have :).
     I have just passed EX294 today with 240/300.

     As an advice for those who will take this exam in the future: you really need to solve the exercicess fast. you need to have very very very good practice in order to touch all tasks. I didn t have time to touch two exercices and a third one I didn t finish.
     Also I didn t like that I couldn’t configure my .vimrc (or idk it didn t work) and I lost precious minutes with indentation – thing that does not happen when I work or practice with ansible.

     Goodluck 2 all!

     Reply

     • Thanks for your feedback, much appreciated. And well done passing the exam!

103. Hi Everyone!
     Hope you are keeping safe! qq: Any idea if there is access to Ansible Galaxy roles on EX294?

     Thanks,
     jn

     Reply

     • Internet access is not allowed during the exam, but if you require to use a role, it will be provided.

104. Hi! Thank you for your shared experience! Could you tell, did you have questions on exam about vagrant and dynamic inventory?
     Thank you a lot!

     Reply

     • Hi Dmitriy, I’m afraid I can’t tell you what’s on the exam, sorry!

105. Hi Tomas,

     Thanks for the sample exam, it is a great exercise. I am having trouble understanding Task 15. Setting the fact is easy, but I cannot understand how it can be retrieved from ansible_local.custom.sample_exam. Can you please give me hint?

     A custom Ansible fact server_role=mysql is created that can be retrieved from ansible_local.custom.sample_exam when using Ansible setup module.

     Reply

     • You can create your own custom facts that can be gathered by Ansible. Facts live in /etc/ansible/facts.d/.

106. Thanks for this awesome labs !

     Reply

107. Hi Tomas,
     I cannot understand what the role in exercise 12 (Security) is for ?
     Can it work this way?
     —
     – name: Secuity
     hosts: webserver
     become: true
     tashs:
     – name: “Set httpd_can_network_connect flag on and keep it persistent across reboots”
     seboolean:
     name: httpd_can_network_connect
     state: yes
     persistent: yes

     Reply

108. Hi,
     Did anyone here take the EX447 exam and could offer me some tips on what to study, especially for git and Tower (API)?
     Thanks!

     Reply

109. I don’t see how I can use the templates module to complete task 18. I did it this way however:

     —
     – hosts: all
     become: yes
     tasks:
     – name: create server list
     lineinfile:
     path: /home/automation/plays/server_list
     line: ‘{{ ansible_fqdn }}’
     create: yes
     delegate_to: 127.0.0.1
     – name: copy server list
     copy:
     src: /home/automation/plays/server_list
     dest: /etc/server_list.txt
     owner: automation
     mode: 0600
     setype: net_conf_t
     – name: delete server list
     file:
     path: /home/automation/plays/server_list
     state: absent
     delegate_to: 127.0.0.1

     The result is not a ordered list, but gets the job done:
     [[email protected] ~]$ cat /etc/server_list.txt
     ansible2.hl.local
     ansible5.hl.local
     ansible3.hl.local
     ansible4.hl.local

     Any hints on a better way of doing this?

     Reply

     • As per requirements – the file server_list.txt should update in case the inventory changes/updates – so the best way would be to use ‘template’ module. This particular task is very easy to achieve using the “template”.
       Hint – look at the “magic variables” ->
       To get a list of what they contain, run:
       ansible localhost -m debug -a “var=hostvars”

       Hope this helps. Good luck.

     • i still do not get how to make loop …
       i got this so far:

       —
       – name: task_18_custom_template
       hosts: database
       become: true
       vars:
       zdroj: /home/automation/plays/server_list.j2
       ciel: /etc/server_list.txt
       tasks:
       – name:
       template:
       src: “{{ zdroj }}”
       dest: “{{ ciel }}”
       owner: automation
       mode: ‘0600’
       setype: net_conf_t

       [[email protected] plays]$ cat server_list.j2
       {% for inventory_hostname in groups[‘servers’] %}
       {{ ansible_facts.fqdn }}
       {% endfor %}

       i dont know how to force template to make correct loop ..aaaa
       can you direct me a bit pls ..

       thanks

110. Hi Tomas, thanks you for sharing this.
     I have a question when i run the authorized_key in the adhoc command for task number2 ansible all –ask-pass -m authorized_key -a ‘user=automation state=present key=”{{lookup(‘file’, ‘/home/automation/.ssh/id_rsa.pub}}”‘
     I always get this error:
     template error : unexpected ‘/’.string: key=”{{lookup(‘file’, ‘/home/automation/.ssh/id_rsa.pub}}”
     Why am i getting this error ?
     Thank you.

     Reply

     • You seem to have a missing closing quotation mark after /home/automation/.ssh/id_rsa.pub.

111. Hey Tomas, i have a “general” question (not necessarily about this test, but i couldn’t find any example on the internet)
     when working with ansible-vault is it possible to use the protected data, but withouth the need of using the “–ask-vault-pass”, “–vault-id” or any of the call methods from the CLI.
     to put it simple, is there any way to ONLY run “ansible-playbook playbook.yml” when the playbook uses protected data?

     (ps: i believe the only way is to set the vault_key file location in ansible.cfg?)

     Reply

     • Hi Nick, if you don’t provide the vault password on the CLI, then you have to store it somewhere in a file.

       You can do something like this:

       ansible-playbook --vault-password-file=vault_secret.txt playbook.yml

     • Hey Nick,
       The answer to Your question is Yes – You can run a playbook containing Vault encrypted data without providing the command line arguments for vault pass or id-> look in the /etc/ansible/ansible.cfg and You will figure out the way.
       Good luck.

112. Hello Thomas,
     Would you please advise with task 11 “Use geerlingguy.haproxy

     The proxy server installed and haproxy service active, and firewall port 80 added however when am curl://proxy_server
     i have error
     503 Service Unavailable
     No server is available to handle this request.

     also via web: 503 Service Unavailable
     Please see output from files below:

     # vim haproxy.yml
     —
     – name: task_11
     hosts: proxy
     become: yes
     roles:
     – geerlingguy.haproxy
     vars:
     haproxy_frontend_mode: ‘http’
     haproxy_backend_port: 80
     haproxy_backend_balance_method: ’roundrobin’
     haproxy_backend_servers:
     – name: node1
     address: 192.168.1.80:80
     – name: node2
     address: 192.168.55.63:80

     tasks:
     – name: install firewalld
     yum:
     name: firewalld
     state: present
     – name: satrt service
     service:
     name: firewalld
     state: started
     enabled: yes
     – name: configure firewall 80
     firewalld:
     port: 80/tcp
     state: enabled
     permanent: yes
     immediate: yes
     and
     # vim/etc/haproxy/haproxy.cfg
     global
     log /dev/log local0
     log /dev/log local1 notice
     stats socket /var/lib/haproxy/stats level admin
     chroot /var/lib/haproxy
     user haproxy
     group haproxy
     daemon

     defaults
     log global
     mode http
     option httplog
     option dontlognull
     timeout connect 5000
     timeout client 50000
     timeout server 50000

     frontend hafrontend
     bind *:80
     mode http
     default_backend habackend

     backend habackend
     mode http
     balance roundrobin
     option forwardfor
     option httpchk HEAD / HTTP/1.1\r\nHost:localhost
     cookie SERVERID insert indirect
     server node1 192.168.1.80:80 cookie node1 check
     server node2 192.168.55.63:80 cookie node2 check

     Please advice

     Many thanks,
     Przemo

     Reply

     • Are your backend servers reachable? What happens if you attempt to curl them directly?

113. Hi Tomas,

     Task 2 questions were sounding bit confusing, it did not clearly mention if the ssh keys to be generated on root or automation user on controller, since it was mentioned that we need to use automation user for all plays/tasks I believe keys to be generated will be for automation user – just wondering if the questions will be similarly phrased in exam as well?

     Reply

     • It doesn’t matter, you can use any user to generate a keypair. The outcome of the task is clearly stated: as long as the SSH key that you generated gets copied to all inventory hosts for the automation user and you can SSH into all inventory hosts using the automation user without a password, you have completed the task.

114. Hi, Tomas,

     I have two questions for you:
     1. Is the resolution of machine hostnames resolved by a DNS or do I need to add entries in the /etc/hosts file?

     2 . In Task 2: Ad-Hoc Commands, the command to create the automation user and deploy the public key, must be done so that the root password is given in input (stdin) or just run the script and each time type the root password for each machine?

     Reply

     • Hi Riccardo, you can use the hosts file if you don’t have a working DNS server, either way is fine.

       With regards to the second question, again, either way is fine, as long as the ad-hoc command creates the user.

115. Hello,

     The sixth task is giving me headache since yesterday, and I feel lost:
     “Each user should have an SSH key uploaded (use the SSH key that you created previously, see task #2).”

     And in an anwser you said:
     You can reuse the same SSH keys as many times and on as many users as you want.

     and when someone asks this:
     How would the key from one user allow another user to ssh to a remote server ?

     You said: It’s the same key. It’s like using the same password on multiple accounts.

     Can you please give an example (outside of the exam question), where you have two users a and b on two servers server1 and server2, let’s say you logged as user a and created private/public ssh keys for this user, did ssh-copy-id and now this user can ssh to server 2 without password.
     Now how I can reuse the same public key of user a for user b and then ssh to server2 as user b without password ?

     From what I see we can’t reuse the same public key.

     Reply

     • Generate an SSH keypair using ssh-keygen. If you don’t change the filename, you’ll normally get two files created, id_rsa and id_rsa.pub. The first one is your private key, and the second one is your public key. If you have two (or more) users on different servers, you can use those keys for both/all of them. What that means is that the users will use the same key. Simply copy the private key and save it as ${HOME}/.ssh/id_rsa, then copy the public key and save it as ${HOME}/.ssh/authorized_keys. Regardless of the actual username, you can repeat this process for as many Linux accounts as you need.

     • Thank for the details !
       After testing this yesterday, I have to say that you were right, I want just to add in case we didn’t copy the private key of user.a to the home directory of user.b ,we need to login as user.a and then do ssh [email protected] or do this:
sudo -u user.a ssh [email protected]

     • You’re welcome!

116. Hi Tomas.
     Thank you for this, it is very helpful.
     when I arrived to task 6 … the ssh part it worked if i used that one key that I generated in the earlier however for outside of this sample exam i tried to generate a different ssh for every user and after i ran the playbook the files are copied correctly to every host but every time I try to connect it asks me for a password !?
     I’ve had a really hard time figuring it out ? is it because of the private key ? and if so how can I overcome this problem?
     Thank you very much.

     Reply

     • When you try to connect, what private key do you use? Your private key has to match the user it has been deployed to.

117. Hi Tomas ,
     for the conduct of exercise n° 6.
     – Each user should have an SSH key uploaded (use the SSH key that you created previously, see task #2).
     After running the playbook, users should be able to SSH into their respective servers without passwords.

     I tried to solve it this way in the playbook:
     – name: “Private Key for alice”
     copy:
     src: /home/automation/.ssh/id_rsa
     dest: /home/{{ item.username }}/.ssh/id_rsa
     owner: “{{ item.username }}”
     group: “{{ item.username }}”
     mode: ‘0600’
     with_items: “{{ users }}”
     when:
     – item.username == ‘alice’
     – “‘webservers’ in group_names”

     – name: Remove public key
     file:
     path: /home/{{ item.username }}/.ssh/id_rsa.pub
     state: absent
     with_items: “{{ users }}”
     when:
     – item.username == ‘alice’
     – “‘webservers’ in group_names”

     – name: “Authorized key for alice”
     copy:
     src: /home/automation/.ssh/id_rsa.pub
     dest: /home/{{ item.username }}/.ssh/authorized_keys
     owner: “{{ item.username }}”
     group: “{{ item.username }}”
     mode: ‘0600’
     with_items: “{{ users }}”
     when:
     – item.uid|string|first == ‘1’
     – “‘webservers’ in group_names”

     Can it be a good solution?
     Thanks

     Reply

     • If it works, then it’s a good solution I think.

118. Tomas
     Any books you recommend to help with the exam?

     Reply

     • Hi Patrick, I didn’t use any to be honest with you, therefore can’t recommend much, sorry.

       Ansible documentation website was one of my main study resources if that helps.

119. Hi Tomas,
     I saw a files directory in your homelab3, with each of the users unique SSH public key file.
     Please if could explain how to create such a files directory.

     Thanks Jules!

     Reply

     • Hi Jules, it’s actually the opposite, if you open the files, you will notice that all users share the same SSH key. These files are stored on the control node, you can create them manually.

120. Thanks very much for help Tomas!

     Reply

121. Hi. Tomas, thank you for cool sample of EX-294. I’m preparing for this exam and your sample is very useful.
     I want to ask about Mysql task (Task 9). As I know in CentOS we should use mariaDB. I installed mariaDB instead mysql-community-server and mysql_user module don’t work well. What is preferred way to manage user passwords on mysql?

     Reply

     • by СentOS, I meant CentOS 8

     • Hi Anatoliy, I use MySQL and manage passwords using mysql_user module. MariaDB might be different, I’m no sure.

     • I have solved it by using python3-MySQL and mariaDB,

122. Hi Tomas,

     When I create a repo as per Task 8, mysql-community-server installation on Centos 8 is not working. Have you tried on Centos 8?

     Thanks,
     Rajesh

     Reply

     • Hi Rajesh, no, I’ve not tried that on CentOS 8.

     • ok thanks

123. Dear Tomas,

     An excellent sample exam!!
     Going to take the EX407 tomorrow, wish me luck.

     1 thing threw me off, and looking at the comments i’m not the only one.
     Task 6 last question: is this the SSH key of the automation user, that you are revering to?(not the SSH public key of the automation user)
     Because the last line says:
     After running the playbook, users should be able to SSH into their respective servers without passwords.
     Means that i distribute the SSH key and SSH public key?

     Regards, Dennis

     Reply

     • I hope that your exam went well!

       To answer your question, yes, there is a single SSH key that you have to generate and use for this sample exam.

124. Hi Tomas,

     Should I create the user “automate” anyway even if I was not asked for ?

     Thanks,
     Ikram

     Reply

     • Hi, I think that you shouldn’t.

125. Hey Tomas,

     Any advice on how to learn Ansible as a first time beginner? so many resources but get put off as Ansible does look a bit challenging. How did you go about gaining Ansible knowledge? :)

     Reply

     • Hi Niraj,

       My advise would be to start with simple things that you use daily, and gradually progress to more complicated services. I started with writing playbooks that install packages and configure firewall rules. My goal was to have a basic Apache webserver running that displayed a static page.

       Then I started using Ansible variables, vault and templates. After that I moved on to using Ansible roles and even writing my own ones. It will require a lot of practice, but that’s the way forward if you want to learn it.

126. Hi Tomas,
     how would you go about “zeroing” a file with Ansible aka removing it’s contents completely and replacing it with just a single line?

     Reply

     • I would use the copy module.

     • Thanks, that was exactly what I was looking for!

     • Also, let’s take into account the following scenario:
       – multiple LVM actions are required on all of the inventory, such as creating the partition, the VG, LV and finally the filesystem
       – let’s say that nodes setup is inconsistent, that is some nodes don’t have the extra disk, while others have it, but it’s too small for the required LV size, for example
       Now, I would use ignore_errors and use the fail module, together with registering the command results to display certain messages where they apply, such as “no sdb here” or “not enough space for the LV, thus we are creating a smaller one”.
       Is such a solution acceptable in your opinion? Would there be a more “professional” approach?

       Thanks.

     • I think it’s a good solution. The approach sounds logical to me and more importantly, it does the job.

127. thx sir for sharing this to us….is there any place where i can get the playbooks answering the questions??? just for estudy purposes…any git hub repo or so???

     thx in advance!!!!

     Reply

     • I’m sorry, as with the real exam, no answers to the sample exam questions are provided.

128. I’m preparing to take the exam next month, I’m confused with TASK #2.

     I’m assuming scripts need to be run as the original user with root access. I KNOW we can’t run as automation user on managed nodes, as they are not created. And if that’s the case, why are the stored with the automation user as script “adhoc”. Why would we create a script that can’t be run as the user.

     Can someone explain how this is suppose to work?

     Reply

     • Hi Darryl, first of all, good luck with your studies!

       This is just a sample exam, therefore the questions may not necessarily reflect real life use cases.

       The scenario of the sample exam is that you have no regular users on your managed hosts, but you do have root access. In theory you can create the ad-hoc script anywhere you like on the OS. In this particular case the script is /home/automation/plays/adhoc, but feel free to create it elsewhere if that helps you. I believe that the confusion is the username that needs creating – automation. If I asked you to create a user called alice on all managed host, would that clarify the confusion for you?

129. Tomas

     Thank man for time you have place into this. I’m serious, i do really appreciated it.

     I’m getting literally paid to get my ansible certification, so its my job. I already went through linux academy’s training, which was great. I need more practice before taking the exam. I have been using ansible for years but haven’t used many of the features.

     My confusion is that configured the ansible.cfg to use automation user in TASK #1, I always set my environment variable ANSIBLE_CONFIG in .bash_profile to the ansible.cfg that I want to use. I created the ad hoc script in location as you specified. If I use my original user (my username points to root) to run it fails as it tries to use automation user from ansible.cfg AND if I switch to the automation user to run, it fails because automation user isn’t created on the system. Does this script need to be run and successful in current configuration?

     Reply

     • Thanks for your kind words Darryl. As always, I’m glad to know that you find the material useful.

       Task #1 says that you have to use the automation user for all sample exam tasks and playbooks, unless you are working on task #2 that requires creating the automation user on inventory hosts. Note how the username is the same, but in reality it does not have to be. It can be anything. I could’ve asked you to create a user called alice, but I didn’t. Why? Because this throws a curveball. Something that you should be prepared for when you take the real exam (again, this is just a sample exam that I had created before I took EX407).

       For task #2, Ansible will default to running from your user account. However, you can use the -u root switch to connect as a different user, e.g. root. You already know the root password in this sample exam scenario because these are your servers, therefore it is sufficient to solve the question. I hope this clarifies things.

     • Just adding to this my own 2 cents on the same task (which is not really as straight-forward to complete as it may sound) – as I was also trying to resolve it in different ways:
       1. “use the “automation” user for all sample exam tasks” -> Well that is not a big deal, if You read /etc/ansible/ansible.cfg “default” configuration, BUT the question is:
       1.1 in Ansible – You can specify the “become” user in two ways (as far as I am aware):
       a -> using “-b” flag -> and that means that on local machine(ansible control node in this case) it runs task as whatever current user is, then connect as the user-name specified in Your ansible.cfg file – and as that user will “sudo” on the remote host. What that means for this particular task – is that this is not the correct way to accomplish this – as user does not yet exist on the remote host and keys are also not yet setup (that is the actual task)
       b -> as Tomas mentioned – using “-u root” flag, which effectively means: on the localhost (same, ansible control machine) “become” root – and then, being root – connect to ansible managed nodes as root (so key-less authentication root->root must already be in place between the control and managed nodes) and then, as root, perform that tasks on the managed nodes. All good with that, BUT that means that on local host (control node) current user (automation in this case) must be allowed/privileged to do “sudo su -” -> so to do that – You need to tweek it’s permissions not only on the managed nodes, but also on the control node.

       All above may sound a bit “messy” – but that was the only way I managed to acomplish the task (using method “b”)
       Would love to hear other views on this.
       BTW, Tomas – Thx for putting together this exercises set.
       Rgds, kalihawk

     • Just to clarify, the flag -b invokes privilege escalation on the remote node for whatever remote user you are using.

       The flag -u specifies the remote username to use to login to the remote node instead of the current user.

     • Tomas, Thx for Your update’ response
       I worked on this task again today and that is, in fact, correct as You formulated:
       “Just to clarify, the flag -b invokes privilege escalation on the remote node for whatever remote user you are using.
       The flag -u specifies the remote username to use to login to the remote node instead of the current user.”

       So my previous solution was not entirely correct, and You do not need privileged permissions for the current user(i.e “automation”) to use “-u root” but, instead the solution is to have the correct remote authentication method (hint: There is already access to root account on all servers – so that should be sufficient to set-up the correct cross-servers authentication for any user-account).

       Hope this helps
       Good luck’ with the Prep’ for this exam.

130. Ha ha, sorry man I missed that completely. Thanks again. Yeah, that makes perfect sense, thank. This is a real good test. I do have another question and you might not have the answer, this isn’t on the practice exam. I need to hash password with sha-512. I can download many programs to do it, but are there any base Redhat programs to hash passwords. I thought openssl would have the proper hash but it doesn’t.

     Reply

     • No worries Darryl. With regards to passwords and SHA512, does this help?

       https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/

131. Thanks a million again, that’s perfect. I never had to deal with passwords or vault even though been using ansible for many years.

     I finished entire practice exam, I’m actually going to start over and do it again.

     I did have two issues that I didn’t really resolve, failed to set the root password on mysql using the mysql_user module and custom fact. My fact.yml create /etc/ansible/fact.d/custom in ini format on target host. I can retrieve all my facts on command line using filter “*ansible_local*” but empty on filter “*ansible_local.custom.sample_exam*”. Even though my results on “*ansible_local*” filter look like this:

     ansible5 | SUCCESS => {
     “ansible_facts”: {
     “ansible_local”: {
     “custom”: {
     “sample_exam”: {
     “datacenter”: “alexandria”,
     “server_role”: “mysql”,
     “type”: “physical”
     }
     }
     },
     “discovered_interpreter_python”: “/usr/bin/python”
     },
     “changed”: false
     }

     Do you have any ideas why filter isn’t working?

     Reply

     • Darryl – You missed one important thing when naming Your custom fact file, have a look at the Ansible documentation and hope that will help You “fix” the issue – pay attention to naming convention.
       Good Luck

       https://docs.ansible.com/ansible/devel/user_guide/playbooks_vars_facts.html#adding-custom-facts

     • Hey, Darryl
       I would like to update my previous answer. While working on the same task today – I happened to observe the same behavior (can see the local_facts but not particular value of a “target” fact):
       ———————————————————————————————————————
       [[email protected]]$ ansible node1 -m setup -a “filter=ansible_local”
       node1 | SUCCESS => {
       “ansible_facts”: {
       “ansible_local”: {
       “custom”: {
       “sample_exam”: {
       “server_role”: “mysql”
       }
       }
       },
       “discovered_interpreter_python”: “/usr/bin/python”
       },
       “changed”: false
       }

       [[email protected]]$ ansible node1 -m setup -a “filter=ansible_local.custom.sample_exam”
       node1 | SUCCESS => {
       “ansible_facts”: {
       “discovered_interpreter_python”: “/usr/bin/python”
       },
       “changed”: false
       }
       [[email protected]]$
       ———————————————————————
       However, that does not mean that is wrong – as same behavior happens when working with ansible_facts:

       [[email protected]]$ ansible node1 -m setup -a “filter=ansible_default_ipv4”
       node1 | SUCCESS => {
       “ansible_facts”: {
       “ansible_default_ipv4”: {
       “address”: “172.xxxxxxx”,
       “alias”: “ens5”,
       “broadcast”: “172.xxxxxxx”,
       “gateway”: “172.xxxxxx”,
       “interface”: “ens5”,
       “macaddress”: “xxxxxxxx”,
       “mtu”: 9001,
       “netmask”: “255.xxxxxxxxx”,
       “network”: “172.xxxxxxxx”,
       “type”: “ether”
       },
       “discovered_interpreter_python”: “/usr/bin/python”
       },
       “changed”: false
       }
       [[email protected]]$ ansible node1 -m setup -a “filter=ansible_default_ipv4.address”
       node1 | SUCCESS => {
       “ansible_facts”: {
       “discovered_interpreter_python”: “/usr/bin/python”
       },
       “changed”: false
       }
       [[email protected]]$

       ————————————————————————————————————————–
       But then, to confirm it has been set-up correctly, I used “debug” module to retrieve the local_fact value – and that worked correctly, so I am still reading on this – why can not retrieve using the “setup” module, but works using the “debug” module:
       ——————————————-
       In the playbook:
       – name: print local fact
       debug:
       msg: “{{ ansible_local.custom.sample_exam.server_role }}”
       ——————————————–
       TASK [print local fact] **********************************************************************************************
       ok: [node1] => {
       “msg”: “mysql”

       ——————————————–
       Would be interesting to hear other opinions on this – but that seem the “correct” behavior, as far as I can say from my limited knowledge.
       Good luck

132. Hi Tomas, excellent sample exam, thank you so much. It helped me a lot. I found the 2.7 exam quite tricky to be honest, there were a couple of things that threw me off, but your exam was a huge assistance, thank you again!

     Reply

     • Nice, thanks for letting me know!

133. Hi Tomas,

     Thanks for your sample exam. I have passed the exam. Your sample exam helped me a lot. Much appreciated.

     Reply

     • Well done Rajesh, you are welcome!

134. These examples are awesome. I have worked through all of them but I am stuck on task 11 with the haproxy role. Is the intent to dynamically build the backend server list from the webservers group? If so, here are my struggles and was wondering if I could get just the slightest hint?
     – The instructions say that the playbook should only run against the proxy group. In this case, how do you collect the appropriate info from the webservers group?
     – Given that the proper data can be collected, is there a way to construct the backend server list dynamically? I envision looping over the weservers group and adding a row to the list each time but I cans seem to locate the proper way to do the actual add.

     Reply

     • Hi Troy, you know the servers in the webservers group already, therefore collecting such info dynamically isn’t necessary in this case.

     • Yeah, maybe dynamic wasn’t the best choice of words. My struggle is that I figure we don’t want to hard code the back end server list but rather it should query the webserver group each time it is run. I know to loop on groups[‘webservers’] to do that but I can’t seem to get how to then properly format the backend_servers var from within that loop. In addition the instructions state that the playbook should be run against the proxy group. If webservers is not included in the hosts definition of the playbook, I do not seem to get ansible_facts which I believe are needed for the backend list.

     • You can if you would like. The approach i took is running the playbook against proxy and webservers group. I then used a block so i can only run the tasks on the proxy group. I will leave it at that and if you need more help, feel free to ask.

     • WOO HOO RHCE Test Passed. Your sample test questions were a tremendous help. Thank you!!!!

     • Well done, congratulations!

135. Hi Tomas

     Thanks for posting sample exam questions it will be very helpful for me but can you give me tips how to memorize YAML playbook syntax for RHCE EX294 Exam. Is there any sample playbook in server which I can refer during exam or any man page?

     Thanks & Regards
     Charanjit Singh

     Reply

     • What I did is I wrote playbooks over and over in my homelab until I was able do that from memory. Also, it helped to configure vim for space indentation.

     • For specific modules you can use ansible-doc in combination with the “-s” flag which prints out the usage of the module with all parameters.

       For a complete playbook you probably can check the example playbooks which come with the rhel-system-roles package. (search for the files with “rpm -ql rhel-system-roles” after installation…

       Regards
       Markus

136. Thank you, Tomas. I passed EX294(RHCE V8) today. Your sample exam helps me a lot.
     Have a nice day sir.

     Reply

     • Good job, well done!

     • Congrats Htunn!! You took a classroom or a virtual exam? If virtual, please would you mind sharing your experience as this is new with Red Hat!

137. Hey Tomas,
     I have been using Ansible with AWS and GCP for sometime now and have gone through linux academy course for the same. Is is necessary for me if I take EX407, to be RCHE or any other certified linux expert as my linux knowledge is basic but I am comfortable with Ansible. What do you think?

     Reply

     • RHCE 8 is all about Ansible, therefore if you’re comfortable with it, you can take the exam. Note that you have to have an active RHCSA certification to receive RHCE.

138. After 100+ hours of study, I don’t want to get this wrong if this is specified on the exam and get a zero over something trivial.

     What do you mean by privilege escalation disabled? Does that mean in config we set ‘become’ to false and then for each and every play we must use -b? The documentation says use -b to run operations with become, so wondering if we need to deliberately set become to false in .cfg? Sanders van Vugt suggests to set become to true in .cfg. Would that violate the specification for Task1 here?

     Reply

     • I should say thanks in advance, since often people tell me I come off as too serious when writing ha. I just mean, don’t want to fail over a small misstep. I am assuming if become is set to false, then we must use the option -b with all playbooks that require sudo privileges. Can you tell me if this is correct way of interpreting the instructions. My biggest fear is doing something like this and then having the autograder not use the -b switch and getting a 0 for everything.

     • The sample exam tasks asks you to disable privilege escallation, you can do so by setting become=False in the .cfg file. I hope this clarifies things for you.

139. Hi Tomas,

     i’m not sure about Task 13. In this subtask: “If a server has less than 2048MB of RAM, then the following error message is displayed”, should be done with debug: msg or with fail module and custom msg?

     Reply

     • As long as the error message is displayed, it should be fine.

140. Hi Tomas,
     Today I took the RHCE and it went great, just wanted to thank you this really helped.

     Reply

     • Well done, congratulations!

141. Hello Tomas,

     Thank you so much for this sample exam.

     Could you please help me with the ad-hoc command to create automation user with the hass password..I refereed the link https://www.lisenet.com/2019/ansible-generate-crypted-passwords-for-the-user-module/ but looks like it’s not working for me. I am using Ansible 2.9

     Reply

     • Hi Aditya, thanks for reaching out. What have you tried so far, and what is not working in particular? Can you also post error messages that you get?

     • Hello Tomas,

       Thank you for your reply. I managed to figure out the issue. Thank you once again.

142. Hello Tomas,

     During exam, one should execute the playbook with –

     1. become: yes OR
     2. become_method: sudo

     Please advise..because this simple mistake can lead to failure in exam.

     Reply

     • My advice is to follow exam instructions and use whatever is required. If this isn’t explicitly set then use your best judgement. Example: if a task does not require elevated privileges then don’t use become/sudo. If a task does require elevated privileges, say package installation, then use become/sudo.

     • Great, Thank you for the information.

143. Hello Tomas;
     Thank you so much for this sample exam.
     I have some worries about the firt question. After creating my script, when I run it against target hosts, I have to manualy accept the SSH key from each target (x 4) :-(
     It’s annoyant for me; and I wonder if Examinator could smash me because of this issue.
     Thanks in advance for your answer

     Reply

     • Hi Judi, no worries, you are welcome!

       With regards to your question, you will always have to trust a connection to an SSH server when connecting for the first time. There is no other way around it. An SSH client receives a public key from the server and has no way of knowing whether it should trust it.

     • Hi Judi,
       You can always add ignore host key check to inventory file

       [all:vars]
       ansible_ssh_common_args=’-o StrictHostKeyChecking=no -o userknownhostsfile=/dev/null’

       it’s a work around for known ansible bug that you can’t disable strict host key checking

144. Task 18:
     When RH asks for persistent changes – what’s about the setype?
     If I just use the setype-parameter it is changed, but won’t survive a full relable or restorecon run, but a normal reboot. Is this enough or should I use sefcontext before creation of the file?

     Any experiences with this?
     Regards
     markus

     Reply

145. Hi Tomas
     Thanks for the above Questions, i have been going through them they quite helpful, do you perhaps have the updated ones with solutions?

     Thanks

     Reply

     • Hi Wilson, you’re welcome. What “updated ones” are you referring to?

146. Hello, Tomas. Sorry to hijack the comments but I am in dire need of your expertise. A monumental task for me (of paramount importance) would likely be greatly simplified with a snippet of your advice. Are you able to email me at the address I provide to post here? TIA if you can do so.

     Reply

     • Hi Andy, what is it that you need help with?

147. Hi Guys,
     Task 9,
     Configure MySQL root user password.
     I encountered the error,
     fatal: [node4.ansi.example.com]: FAILED! => {“changed”: false, “msg”: “unable to connect to database, check login_user and login_password are correct or /root/.my.cnf has the credentials. Exception message: (2003, \”Can’t connect to MySQL server on ‘localhost’ ([Errno 111] Connection refused)\”)”}

     Any idea how to handle this? Try so many matter also failed.
     I’m using mysql_user module to change the root db password.

     Reply

148. Hi Tomas
     In the examination objectives, there are the following requirements:
     – Use both static and dynamic inventories to define groups of hosts
     – Utilize an existing dynamic inventory script

     that however I have not seen used in the exercises proposed by you.
     Do you think they may be there during the exam?
     Thank you again for your valuable work

     Best Regards
     Riccardo

     Reply

     • Hi Riccardo, I’m aware. There are no questions related to dynamic inventory in my sample exam because it would make the set up too complicated. Any exam objective is a fair game, my advice is to be familiar with all of them.

       You can use KVM, Proxmox or AWS to practise dynamic inventory.

149. Hello Tomas,

     Thank you very much for preparing a sample exam. If one is able to solve this sample exam, will he/she be able to pass the actual redhat ex407 exam?

     Reply

     • Hi Sansa, you will be in a strong position to pass the real exam.