I85PREP
⌘ K
RHCE study materials
RHCE study resources

RHCE practice questions

One question at a time. Build your RHCE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Understand and use core Ansible components

When no inventory is given on the command line and no configuration file overrides the setting, which file does Ansible read as its default inventory?

  1. /var/lib/ansible/hosts
  2. /etc/ansible/hosts Correct answer.
  3. /etc/ansible/inventory
  4. ~/.ansible/hosts

Explanation

The shipped ansible.cfg sets inventory = /etc/ansible/hosts, so that path is used when nothing else specifies an inventory. A project ansible.cfg, the ANSIBLE_CONFIG variable, or the -i option all take precedence over it.

Question 2Understand and use core Ansible components

Which ad-hoc command runs the ping module against every host in the inventory?

  1. ansible-ping all
  2. ansible-playbook all -m ping
  3. ansible all -m ping Correct answer.
  4. ansible all ping

Explanation

Ad-hoc syntax is ansible <host-pattern> -m <module>, so ansible all -m ping runs ping against all inventory hosts. ansible-playbook expects a playbook file rather than a host pattern.

Question 3Understand and use core Ansible components

In a playbook, which keyword names the hosts or groups to which a play applies?

  1. inventory
  2. targets
  3. hosts Correct answer.
  4. nodes

Explanation

Each play is a list item with a hosts key whose value is a host pattern such as all, webservers, or a wildcard. The remaining play keywords such as tasks, vars, and become describe what happens on those hosts.

Question 4Understand and use core Ansible components

When does a handler task execute?

  1. When a task that notifies it reports changed Correct answer.
  2. Only when --tags handlers is used
  3. Whenever any task in the play reports changed
  4. Each time the play begins

Explanation

A handler runs only if a task notifies it and that notifying task returns a changed result. Handlers then run once, at the end of the play or earlier if handlers are flushed, even if several tasks notified the same handler.

Question 5Understand and use core Ansible components

Which of these is a valid Ansible variable name?

  1. web-port
  2. _web_port Correct answer.
  3. 2nd_host
  4. web port

Explanation

Variable names may contain letters, digits, and underscores and must begin with a letter or an underscore. Hyphens and spaces are not permitted, and a leading digit is invalid.

Question 6Understand and use core Ansible components

After fact gathering, which variable holds the fully qualified domain name reported by the managed host?

  1. ansible_hostname
  2. ansible_fqdn Correct answer.
  3. ansible_default_ipv4
  4. ansible_domain

Explanation

ansible_fqdn contains the fully qualified name of the managed node as reported by gathered facts. ansible_hostname holds only the short name and ansible_domain holds only the domain portion.

Question 7Understand and use core Ansible components

With no ANSIBLE_CONFIG environment variable set, which configuration file takes precedence over the others?

  1. ~/.ansible.cfg in the user's home directory
  2. /usr/share/ansible/ansible.cfg
  3. ./ansible.cfg in the current directory Correct answer.
  4. /etc/ansible/ansible.cfg

Explanation

Precedence runs from ANSIBLE_CONFIG, then ./ansible.cfg in the current working directory, then ~/.ansible.cfg, then /etc/ansible/ansible.cfg. The first file found is the only one used; the others are ignored rather than merged.

Question 8Understand and use core Ansible components

In the standard role directory layout, which directory holds variable values that are meant to be easily overridden?

  1. meta
  2. files
  3. defaults Correct answer.
  4. vars

Explanation

defaults/main.yml holds role default variables and has the lowest precedence of any variable source, so consumers of the role can override them. vars/main.yml holds role variables that are much harder to override.

Question 9Understand and use core Ansible components

Which command displays the documentation and parameter list for the builtin copy module?

  1. ansible-config copy
  2. ansible-doc copy Correct answer.
  3. ansible --help copy
  4. ansible-doc --list copy

Explanation

ansible-doc followed by a module name prints that module's documentation, including options and examples. The -l or --list flag instead lists every available module and takes no module name.

Question 10Understand and use core Ansible components

Which keyword feeds a list of values to a task so that the task runs once for each value?

  1. loop Correct answer.
  2. foreach
  3. iterate
  4. each_value

Explanation

The loop keyword takes a list and repeats the task once per element, exposing the current element as the variable item. Legacy with_<lookup> keywords still exist but loop is the current general form.

Question 11Understand and use core Ansible components

Which task keyword evaluates an expression and skips the task when the result is false?

  1. if
  2. when Correct answer.
  3. assert
  4. condition

Explanation

The when keyword takes a raw Jinja2 expression, without curly braces, and the task runs only when the expression evaluates to true. The assert module performs a similar test but fails the task rather than skipping it.

Question 12Understand and use core Ansible components

Which command-line option limits a playbook run to tasks carrying the tag config?

  1. --only-tags config
  2. --limit config
  3. --filter config
  4. --tags config Correct answer.

Explanation

The --tags option, abbreviated -t, selects only tasks and plays that carry at least one of the listed tags. The --limit option instead restricts which hosts are targeted.

Question 13Understand and use core Ansible components

Which play-level keyword makes every task in the play run with sudo by default?

  1. become: true Correct answer.
  2. escalate: true
  3. sudo: true
  4. root: true

Explanation

Privilege escalation is controlled by become, together with become_method and become_user when the defaults are not suitable. Setting become at play level applies it to all tasks in the play unless a task overrides it.

Question 14Understand and use core Ansible components

Which syntax inserts the value of the variable http_port into a Jinja2 template?

  1. {% http_port %}
  2. ${http_port}
  3. {{ http_port }} Correct answer.
  4. [% http_port %]

Explanation

Double curly braces delimit a Jinja2 expression whose value is rendered into the output. Curly-brace-percent blocks are used for statements such as if and for, and the other forms are not Jinja2 syntax.

Question 15Understand and use core Ansible components

Which command encrypts an existing plaintext file so that Ansible Vault can manage it?

  1. ansible-vault lock secrets.yml
  2. ansible-vault encrypt secrets.yml Correct answer.
  3. ansible-vault edit secrets.yml
  4. ansible-vault create secrets.yml

Explanation

ansible-vault encrypt converts an existing file in place into vault-encrypted content. The create subcommand instead makes a brand-new encrypted file and opens an editor for it.

Question 16Understand and use core Ansible components

Inside a block, which section holds tasks that run only when a task in the block fails?

  1. failed
  2. always
  3. rescue Correct answer.
  4. catch

Explanation

A block may contain block, rescue, and always sections; rescue tasks run when any task in the block section fails. The always section runs regardless of success or failure.

Question 17Understand and use core Ansible components

Which task keyword runs a task on a host other than the current play target?

  1. remote_host
  2. delegate_to Correct answer.
  3. run_on
  4. host_redirect

Explanation

delegate_to names an inventory host on which the task actually executes while the play continues to iterate over its normal targets. It is often combined with run_once when the action should happen only once.

Question 18Understand and use core Ansible components

Which Jinja2 filter returns an uppercase copy of a string?

  1. to_upper
  2. title
  3. upper Correct answer.
  4. uppercase

Explanation

The upper filter converts all characters in a string to uppercase, as in {{ name | upper }}. The title filter capitalizes only the first letter of each word.

Question 19Understand and use core Ansible components

Which command installs the community.general collection from Galaxy?

  1. ansible-galaxy collection install community.general Correct answer.
  2. ansible-galaxy collection get community.general
  3. ansible-galaxy install community.general --type collection
  4. ansible-galaxy collection install --role community.general

Explanation

Collections are installed with the ansible-galaxy collection install subcommand followed by the collection name in namespace.name form. Plain ansible-galaxy install is the form used for roles, not collections.

Question 20Understand and use core Ansible components

Which play keyword prevents Ansible from gathering facts at the start of a play?

  1. gather_facts: false Correct answer.
  2. facts: false
  3. setup: false
  4. gather: no

Explanation

The play keyword gather_facts defaults to true and controls the implicit setup run before the first task. Setting it to false skips that run, so fact variables are unavailable unless facts are gathered explicitly later.

Question 21Understand and use core Ansible components

Which construct forces handlers that are already pending to run immediately, before the end of the play?

  1. A task with notify: handlers
  2. A handler declared with listen: now
  3. A meta task with flush_handlers Correct answer.
  4. Setting force_handlers to true in the play

Explanation

The meta module's flush_handlers action runs all handlers notified so far at that point in the play, after which the play continues. Handlers would otherwise be deferred until the end of the play.

Question 22Understand and use core Ansible components

A variable named app_port is defined in the role's defaults/main.yml, in the role's vars/main.yml, and in the play's vars section. Which value is used?

  1. the value from the play vars
  2. the value from role defaults
  3. Ansible aborts because the variable is defined more than once
  4. the value from role vars Correct answer.

Explanation

Variable precedence places role defaults lowest and role vars (vars/main.yml) above play vars, so the role vars value wins among these three. Only extra vars passed with -e outrank broad categories such as role vars and set_fact.

Question 23Understand and use core Ansible components

Which variable holds the list of hosts targeted by the current play that are still active, excluding any that have failed?

  1. inventory_hostname
  2. ansible_play_hosts Correct answer.
  3. groups['all']
  4. ansible_hostname

Explanation

ansible_play_hosts is a magic variable listing the hosts in the current play batch that are still active. The related ansible_play_hosts_all includes hosts that have already failed during the play.

Question 24Understand and use core Ansible components

Which pair of keywords repeats a task until a condition is satisfied, up to a fixed number of attempts?

  1. repeat and until
  2. loop and delay
  3. until and retries Correct answer.
  4. when and retries

Explanation

until supplies the condition that ends the retry loop, retries caps the number of attempts, and delay sets the pause between them. Without a condition the task runs once and the retry keywords have no effect.

Question 25Understand and use core Ansible components

A task using the command module always reports changed even when it changes nothing. Which task keyword corrects the report while still executing the command?

  1. check_mode: true
  2. ignore_errors: true
  3. changed_when: false Correct answer.
  4. failed_when: false

Explanation

command does not know whether it altered the system, so changed_when lets you define the changed status from an expression, and false forces it to report ok. The command still runs; only the reported state is affected.

Question 26Understand and use core Ansible components

When no inventory is passed with -i and none is configured, which path does Ansible use as its default inventory?

  1. /etc/ansible/inventory
  2. ./inventory.ini
  3. /etc/ansible/hosts Correct answer.
  4. /etc/hosts

Explanation

The built-in default for the inventory setting is the file /etc/ansible/hosts, which is where Ansible looks when nothing overrides it. Supplying -i or an inventory entry in ansible.cfg replaces that default.

Question 27Understand and use core Ansible components

Which ad-hoc command runs the ping module against every host in the inventory group named web?

  1. ansible -m ping --group web
  2. ansible-playbook web -m ping
  3. ansible-inventory web -m ping
  4. ansible web -m ping Correct answer.

Explanation

Ad-hoc syntax is ansible <pattern> -m <module>, so the group name is given as the host pattern directly after the ansible command. The pattern selects the targets, and the module flag chooses what to run on them.

Question 28Understand and use core Ansible components

Which module does Ansible invoke to collect facts from a managed host on demand?

  1. ansible.builtin.gather
  2. ansible.builtin.setup Correct answer.
  3. ansible.builtin.facts
  4. ansible.builtin.discover

Explanation

Fact gathering is performed by the setup module, which returns a dictionary of system information. A play's gather_facts keyword simply arranges for setup to run before the first task.

Question 29Understand and use core Ansible components

In an INI-style inventory file, how is a group of hosts declared?

  1. web:
  2. group web { }
  3. - web:
  4. [web] Correct answer.

Explanation

INI inventories use bracketed section headers, so [web] starts a group and every host line beneath it belongs to that group. YAML inventories use a different mapping or list structure instead.

Question 30Understand and use core Ansible components

Two tasks in one play each change a configuration file and both notify the same handler. Both tasks report changed. How many times does that handler run in the play?

  1. Once, when the play's handlers are flushed Correct answer.
  2. Once for every host, multiplied by the number of notifications
  3. Zero times unless the handler is also listed under tasks
  4. Twice, once for each notifying task that reported changed

Explanation

A handler is queued at most once no matter how many tasks notify it, and the queue is flushed at the end of the play or when meta: flush_handlers runs. Repeating the service restart would be wasteful, so Ansible de-duplicates notifications.

Question 31Understand and use core Ansible components

Which keyword inserts a task file into a play at parse time, so that tags and conditionals placed on it also apply to every task inside the file?

  1. import_tasks Correct answer.
  2. include_tasks
  3. import_playbook
  4. include_role

Explanation

import_tasks is static: the file is read while the playbook is parsed, so the imported tasks inherit tags and when conditions from the import statement. include_tasks is dynamic and is processed at run time, so those attributes do not propagate.

Question 32Understand and use core Ansible components

A task file that is itself included inside a loop also uses a loop. Which setting stops the inner loop from overwriting the outer loop's item variable?

  1. loop_var_name inside the loop list
  2. loop_control with loop_var: inner_item Correct answer.
  3. with_items with the outer variable name
  4. register: item

Explanation

loop_control renames the variable that holds the current loop value, so the inner loop can use a distinct name instead of the default item. That keeps the outer loop's item value intact for the rest of the included tasks.

Question 33Understand and use core Ansible components

Which built-in tag makes its tasks run even when a run is limited with --tags, unless they are explicitly excluded with --skip-tags?

  1. never
  2. all
  3. untagged
  4. always Correct answer.

Explanation

Tasks tagged always are executed regardless of which tags were selected, which makes them useful for setup or validation steps. They stop running only when always is named in --skip-tags.

Question 34Understand and use core Ansible components

A play connects as an unprivileged account, but one task must execute as the postgres account with privilege escalation. Which task keywords accomplish this?

  1. sudo: postgres and become_method: sudo
  2. become: true and become_user: postgres Correct answer.
  3. become: postgres and user: root
  4. remote_user: postgres with become: true and become_method: sudo

Explanation

become enables privilege escalation for the task and become_user names the account to escalate to, so the task runs as postgres. Both keywords can be set at task level even when other tasks in the play do not escalate.

Question 35Understand and use core Ansible components

Which variable exposes the variables and facts of every inventory host, so a task on one host can read another host's data?

  1. hostvars Correct answer.
  2. inventory_hostname
  3. ansible_facts
  4. groups

Explanation

hostvars is a dictionary keyed by host name whose values are each host's variables and facts, so hostvars['db1']['ansible_fqdn'] works from any host. This is the standard way to share per-host data across the inventory.

Question 36Understand and use core Ansible components

Which [defaults] setting in ansible.cfg selects the backend used to store gathered facts between playbook runs?

  1. fact_gathering_backend = jsonfile
  2. fact_caching_backend = jsonfile
  3. cache_facts_locally = jsonfile
  4. fact_caching = jsonfile Correct answer.

Explanation

The fact_caching setting names the cache plugin used for facts, and fact_caching_connection tells that plugin where to store them. With both set, later runs can read facts instead of gathering them again.

Question 37Understand and use core Ansible components

Which ansible.cfg entry lets playbook runs decrypt vault-protected files without prompting or an extra command-line flag?

  1. vault_decrypt_key = /etc/ansible/vault_pass.txt
  2. vault_secret_file = /etc/ansible/vault_password_secret.txt
  3. vault_secret_id = /etc/ansible/vault_pass.txt
  4. vault_password_file = /etc/ansible/vault_pass.txt Correct answer.

Explanation

vault_password_file points at a file whose first line is used as the vault password, so no prompt appears and no --vault-password-file flag is needed. It is normally set in the [defaults] section or supplied through ANSIBLE_VAULT_PASSWORD_FILE.

Question 38Understand and use core Ansible components

A task running on host A uses delegate_to to execute on host B, and inside it a set_fact assigns a value. Which keyword makes that fact land on host B rather than host A?

  1. run_once: true
  2. delegate_facts: false
  3. delegate_to_facts: true
  4. delegate_facts: true Correct answer.

Explanation

Facts set inside a delegated task are assigned to the delegating host by default. Setting delegate_facts to true moves the assignment to the host named in delegate_to, which is what lets one host publish a fact for another.

Question 39Understand and use core Ansible components

Which play keyword lets each host move on to its next task as soon as it finishes the current one, instead of waiting for all other hosts at a task boundary?

  1. throttle: 1
  2. strategy: free Correct answer.
  3. serial: 1
  4. gather_facts: false

Explanation

The default linear strategy keeps hosts in lockstep at each task. The free strategy removes that barrier so a fast host can run ahead through the task list while slow hosts continue independently.

Question 40Understand and use core Ansible components

A template contains {{ lookup('file', 'certs/ca.pem') }}. On which machine is that file read?

  1. From the managed host, at the exact path written in the expression
  2. From the managed host's local filesystem after the template is transferred
  3. From the first host of the play, then shared with the remaining hosts
  4. From the control node, relative to the playbook directory Correct answer.

Explanation

Lookup plugins execute in the control node's process while the template is being rendered, so the file must exist on the controller. To read a file from a managed host, a module such as slurp or a remote lookup would be needed.

Question 41Install and configure an Ansible control node

Which environment variable can point Ansible at a specific configuration file?

  1. ANSIBLE_HOME
  2. ANSIBLE_CONFIG Correct answer.
  3. ANSIBLE_INVENTORY
  4. ANSIBLE_CFG

Explanation

Ansible checks ANSIBLE_CONFIG first; when it names a readable file, that file is used and every other candidate location is skipped. Only when the variable is unset does Ansible fall back to the directory and home-file locations.

Question 42Install and configure an Ansible control node

Which command prints every configuration setting together with the value Ansible is currently using?

  1. ansible-config dump Correct answer.
  2. ansible-config list
  3. ansible-config show
  4. ansible-config edit

Explanation

ansible-config dump reports each setting and the effective value after merging defaults, the config file and environment variables. The list subcommand only describes the available options, and edit/show are not real subcommands.

Question 43Install and configure an Ansible control node

When neither the configuration file nor the command line defines an inventory, which path does ansible-core fall back to?

  1. /etc/ansible/hosts.ini
  2. /var/lib/ansible/hosts
  3. /etc/ansible/hosts Correct answer.
  4. /etc/ansible/inventory

Explanation

Without an inventory directive in ansible.cfg and without -i, Ansible uses /etc/ansible/hosts as its inventory source. Modern versions usually warn that this file is empty rather than failing outright.

Question 44Install and configure an Ansible control node

Which command places your public key into the authorized_keys file of a managed host's account?

  1. ssh-add user@host
  2. ssh-copy-id user@host Correct answer.
  3. ssh-agent user@host
  4. scp ~/.ssh/id_rsa.pub user@host

Explanation

ssh-copy-id appends the local public key to ~/.ssh/authorized_keys on the remote account and fixes the ownership and permissions of that file. This lets Ansible log in without a password prompt.

Question 45Install and configure an Ansible control node

On RHEL 9, which package installs the ansible-playbook command with the smallest set of dependencies?

  1. ansible-navigator
  2. python3-ansible
  3. ansible-engine
  4. ansible-core Correct answer.

Explanation

The ansible-core package supplies ansible-playbook, ansible-galaxy, ansible-doc and the built-in modules. The larger ansible package adds a curated bundle of collections on top of it, and ansible-navigator is a separate front end.

Question 46Install and configure an Ansible control node

Which section of ansible.cfg holds become, become_method, become_user and become_ask_pass?

  1. [connection]
  2. [defaults]
  3. [persistent_connection]
  4. [privilege_escalation] Correct answer.

Explanation

Privilege escalation defaults are grouped under the [privilege_escalation] section of ansible.cfg. Setting become = True there applies escalation to every play run with that file.

Question 47Install and configure an Ansible control node

Which command reports the path of the configuration file Ansible is actually using?

  1. ansible-config view
  2. ansible-inventory --list
  3. ansible --version Correct answer.
  4. ansible-doc -t config

Explanation

ansible --version prints the ansible-core version plus a 'config file' line naming the file that was loaded. That line is the quickest confirmation of which ansible.cfg won the precedence chain.

Question 48Install and configure an Ansible control node

Which [defaults] setting disables SSH host key verification for managed hosts?

  1. verify_host_keys = False
  2. host_key_verification = false
  3. gather_facts = false
  4. host_key_checking = False Correct answer.

Explanation

host_key_checking under [defaults] controls whether Ansible rejects hosts whose key is not already in known_hosts. Setting it to False lets the first connection to a new host succeed without manual key approval.

Question 49Install and configure an Ansible control node

ANSIBLE_CONFIG is set, a ./ansible.cfg exists in the current directory, and ~/.ansible.cfg also exists. Which file supplies the settings?

  1. The file named in ANSIBLE_CONFIG Correct answer.
  2. The ~/.ansible.cfg file in the user's home directory
  3. The /etc/ansible/ansible.cfg file shipped with the package
  4. The ./ansible.cfg file in the current working directory

Explanation

Ansible walks the precedence chain ANSIBLE_CONFIG, then ./ansible.cfg, then ~/.ansible.cfg, then /etc/ansible/ansible.cfg. Only the first file found is read; the remaining files are ignored rather than merged.

Question 50Install and configure an Ansible control node

You set the inventory directive in ansible.cfg to a directory path. How does Ansible treat that path?

  1. It fails unless the directory ends with .ini
  2. It reads only the file named hosts inside it
  3. It archives the directory into one tarball first
  4. It reads every file in that directory as inventory Correct answer.

Explanation

An inventory source may be a directory, in which case Ansible parses each file inside it as inventory and skips files it cannot parse. Executable files found there are run as dynamic inventory scripts.