RHCE EX294 Exam Questions: Ten Original Practice Tasks With Solutions

Key takeaways

• EX294 is hands-on. Memorising "dumps" does not work, because you must produce a working configuration on real machines. Real exam content is also covered by Red Hat's confidentiality agreement.
• Practice by building. Each task below is something you should be able to do from a blank terminal using only ansible-doc for help.
• Check the current exam objectives and RHEL version on the Red Hat page before you start, because they change between releases.
• Run every playbook twice. The second run should report no changes. That is how you check idempotence.

What EX294 tests and what it does not

EX294 is the Red Hat Certified Engineer exam. It assumes RHCSA-level Linux skills and tests automation with Ansible: inventories, ad hoc commands, playbooks, variables, facts, templates, roles, Ansible Vault, handlers, error handling and managing common services and storage across many hosts. The official objective list and current exam version are on the Red Hat Training and Certification site. Treat that list as the source of truth, not any third-party question bank.

A pass depends on your result at the end, not on how you got there. You can use ansible-doc and the documentation installed on the exam system, so learn to find module examples quickly. The Ansible documentation is the best study companion.

Why do we not publish exam dumps?

Pages that sell "real questions and answers" for performance-based exams usually offer outdated notes at best. Candidates also agree not to share exam content, and Red Hat can revoke results. They also teach you nothing that helps in a job, where you will face tasks nobody has pre-written. The tasks below are original and written to build the underlying skill.

What lab setup do you need?

You need one control node and two or three managed nodes, which can be virtual machines running RHEL, Rocky Linux or AlmaLinux. Create a user on each, set up SSH keys and passwordless sudo, and install ansible-core on the control node. Use the modules from ansible.builtin, plus ansible.posix and community.general where noted. Confirm what the exam provides before relying on any collection.

Ten practice tasks

Task 1: Inventory and configuration

Create a project directory with an ansible.cfg and an inventory containing groups web and db, with the remote user, sudo and inventory path set.

[defaults]
inventory =./inventory
remote_user = devops
host_key_checking = False

[privilege_escalation]
become = True

[web]
node1.example.com
[db]
node2.example.com
[prod:children]
web
db

Check it with ansible-inventory --graph and ansible all -m ping. Disabling host key checking is acceptable in a lab and wrong in production.

Task 2: Ad hoc commands

Install tmux on all hosts and make sure chronyd is started and enabled on the web group, using only ad hoc commands.

ansible all -m ansible.builtin.dnf -a "name=tmux state=present"
ansible web -m ansible.builtin.service -a "name=chronyd state=started enabled=true"

Task 3: A web server playbook

Install httpd, start and enable it, open HTTP in the firewall, and publish a page showing each host's name from a template.

---
- name: Configure web servers
 hosts: web
 tasks:
 - name: Install httpd
 ansible.builtin.dnf:
 name: httpd
 state: present
 - name: Deploy index page
 ansible.builtin.template:
 src: index.html.j2
 dest: /var/www/html/index.html
 mode: "0644"
 - name: Start and enable httpd
 ansible.builtin.service:
 name: httpd
 state: started
 enabled: true
 - name: Open http in firewalld
 ansible.posix.firewalld:
 service: http
 permanent: true
 immediate: true
 state: enabled

The template can be one line: Welcome to {{ ansible_facts['fqdn'] }}. Run it twice and confirm the second run changes nothing. Then check from the control node with curl.

Task 4: Users and groups from a variable

Create the group devs and users asha and ravi as members, with a loop over a variable list.

- hosts: all
 vars:
 app_users: [asha, ravi]
 tasks:
 - ansible.builtin.group:
 name: devs
 - ansible.builtin.user:
 name: "{{ item }}"
 groups: devs
 append: true
 loop: "{{ app_users }}"

Task 5: Ansible Vault

Store a database password in an encrypted variables file and use it in a playbook without ever printing it.

ansible-vault create secrets.yml # contains: db_pass: S3cretLabOnly
ansible-playbook site.yml --ask-vault-pass
ansible-vault rekey secrets.yml

Use no_log: true on any task that handles the value, and never commit the vault password file.

Task 6: A role

Convert Task 3 into a role named webserver with a handler that restarts httpd when the template changes.

ansible-galaxy init roles/webserver
# roles/webserver/tasks/main.yml: install, template (notify: restart httpd), service, firewalld
# roles/webserver/handlers/main.yml:
- name: restart httpd
 ansible.builtin.service:
 name: httpd
 state: restarted

Call the role from a short playbook with roles: [webserver]. Change the template, run again, and watch the handler fire only once.

Task 7: Conditionals and facts

On hosts with less than 2 GB of RAM, write a message to a file. Use facts, not hard-coded names.

- hosts: all
 tasks:
 - ansible.builtin.copy:
 content: "Low memory host\n"
 dest: /etc/motd.lowmem
 when: ansible_facts['memtotal_mb'] < 2048

Run ansible node1.example.com -m setup to see what facts exist. Learn the names, because guessing costs time.

Task 8: Error handling

Try to start a service that may not exist. If it fails, log the failure, and always write a completion marker.

- hosts: all
 tasks:
 - block:
 - ansible.builtin.service:
 name: demoapp
 state: started
 rescue:
 - ansible.builtin.copy:
 content: "demoapp failed\n"
 dest: /tmp/demoapp.err
 always:
 - ansible.builtin.copy:
 content: "done\n"
 dest: /tmp/run.done

Task 9: Templates with loops over groups

Generate /etc/hosts.managed on every host listing all inventory hosts and their IPs.

{% for h in groups['all'] %}
{{ hostvars[h]['ansible_facts']['default_ipv4']['address'] }} {{ hostvars[h]['ansible_facts']['fqdn'] }}
{% endfor %}

Facts must be gathered for all hosts before the template runs, or hostvars will be empty for some of them. Think about why.

Task 10: Storage and SELinux

Create a logical volume data of 500 MB in volume group vgapp, put an XFS filesystem on it and mount it at /data. Then allow httpd to use network connections with the right SELinux boolean.

- community.general.lvol:
 vg: vgapp
 lv: data
 size: 500m
- community.general.filesystem:
 fstype: xfs
 dev: /dev/vgapp/data
- ansible.posix.mount:
 path: /data
 src: /dev/vgapp/data
 fstype: xfs
 state: mounted
- ansible.posix.seboolean:
 name: httpd_can_network_connect
 state: true
 persistent: true

Know what to do when the volume group has no free space. A good answer checks first with vgs and handles the failure instead of ignoring it.

Common mistakes

• Using shell or command where a module exists. Modules are idempotent and report changes properly.
• Forgetting become and getting permission errors.
• Indentation errors. Run ansible-playbook --syntax-check and ansible-lint if available.
• Not testing the result. A playbook that runs without errors but leaves the service stopped still fails the task.
• Spending ten minutes on one task. Skip, finish the others, and come back.

How to prepare in practice

1. Read the official exam objectives and tick each one off with a task of your own.
2. Redo each task above from memory with only ansible-doc open.
3. Time yourself. Hands-on exams are as much about speed and calm as knowledge.
4. Rebuild the lab from scratch once so you know it works on a clean machine.

Next steps

For preparation advice from the start of the course to exam day, read how to pass the Red Hat Certified Engineer exam. If you want trainer-led lab practice, see the RHCE EX294 course.

Related reading

• CEH V12 Exam Questions | Latest Certified Ethical Hacking CEH V12 Exam Preparation PDF (2026)
• How to Pass RHCE EX294 Certification [ A Success Story] in 1st Attempt.