RHCE EX294 Practice Questions and Answers: Original Ansible Tasks with Solutions

Key takeaways

• RHCE EX294 is a hands-on exam on Ansible automation for Red Hat Enterprise Linux. You are marked on whether your playbooks produce the right result on live systems.
• Real exam questions are confidential. Anyone selling them is breaking Red Hat's rules, and using them puts your certificate at risk.
• The best preparation is writing playbooks from a blank file until you can do each objective without notes.
• The tasks below are original and written to match the published objectives. They are practice, not a prediction of what you will see.
• Always check Red Hat's current objectives for the exam version, the RHEL release and the tooling used.

What is the RHCE EX294 exam?

RHCE, the Red Hat Certified Engineer, is the next step after RHCSA. Exam EX294 tests whether you can automate Linux administration with Ansible. You sit at a live environment, with a control node and several managed nodes, and complete tasks within a time limit. The objectives and current version are on Red Hat's training and certification site. The product documentation is at docs.redhat.com, and the Ansible reference is at docs.ansible.com.

You need a valid RHCSA before RHCE is awarded, in the usual Red Hat path. Check the current rules for that too.

Why are "real exam questions" a bad idea?

Real EX294 questions and answers are not legitimate study material, and generic Linux tasks such as configuring NFS are RHCSA topics, not EX294. Red Hat's candidate agreement prohibits copying or sharing exam content. If you use leaked material and Red Hat finds out, your result can be cancelled. More important, a performance exam cannot be passed by memorising answers. The tasks change, and what is marked is the state of the systems at the end.

How should you prepare?

1. Read the published objectives and turn each one into a task you can do from memory.
2. Build a lab: one control node and three managed nodes on an RHEL-compatible system such as Rocky Linux, AlmaLinux or RHEL with a developer subscription. CentOS Linux is end-of-life and should not be used.
3. Use ansible-doc as your reference. The exam may not give you a web browser, so practise ansible-doc ansible.builtin.user until it is natural.
4. Write every task twice. Run it twice too, to check it is idempotent: the second run should report no changes.

Our guides on how to pass the RHCE exam and 10 tips for the RHCE EX294 exam cover strategy. The version difference is explained in EX294 v8 versus v9.

Practice tasks with worked solutions

Assume the control node has a user devops, the managed nodes are node1 to node3, and the groups are web and db. The solutions use fully qualified collection names, which is good practice.

Task 1: Configure Ansible and the inventory

Task: Create a project directory with an ansible.cfg and an inventory. node1 and node2 are in the group web, node3 is in db. Connect as devops and use privilege escalation.

[defaults]
inventory =./inventory
remote_user = devops
host_key_checking = False

[privilege_escalation]
become = True
become_method = sudo
become_user = root
become_ask_pass = False

[web]
node1
node2

[db]
node3

Check it with ansible all -m ansible.builtin.ping and ansible-inventory --graph.

Task 2: Install packages and start services

Task: Write a playbook that installs httpd on the web group and mariadb-server on the db group, starts and enables both services, and opens the right firewall service.

---
- name: Web servers
 hosts: web
 tasks:
 - name: Install httpd
 ansible.builtin.dnf:
 name: httpd
 state: present

 - name: Start and enable httpd
 ansible.builtin.service:
 name: httpd
 state: started
 enabled: true

 - name: Open http in firewalld
 ansible.posix.firewalld:
 service: http
 permanent: true
 immediate: true
 state: enabled

- name: Database servers
 hosts: db
 tasks:
 - name: Install mariadb-server
 ansible.builtin.dnf:
 name: mariadb-server
 state: present

 - name: Start and enable mariadb
 ansible.builtin.service:
 name: mariadb
 state: started
 enabled: true

Run it with ansible-playbook site.yml. Run it a second time and look for changed=0.

Task 3: Users with Ansible Vault

Task: Create users from a list stored in a variable file. Passwords come from an encrypted vault file. Put the users in the group wheel.

ansible-vault create secrets.yml --vault-password-file vault-pass.txt

Inside secrets.yml put user_password: "ChangeMe123" (use your own value in practice), then:

---
- name: Create users
 hosts: all
 vars_files:
 - secrets.yml
 vars:
 users:
 - alice
 - bob
 tasks:
 - name: Create each user
 ansible.builtin.user:
 name: "{{ item }}"
 groups: wheel
 append: true
 password: "{{ user_password | password_hash('sha512') }}"
 loop: "{{ users }}"

Run with ansible-playbook users.yml --vault-password-file vault-pass.txt. Learn the other vault commands too: view, edit, rekey, encrypt.

Task 4: Template a file with facts

Task: Create /etc/motd on every host showing its hostname and the operating system, using a Jinja2 template.

Welcome to {{ ansible_facts['hostname'] }}.
Operating system: {{ ansible_facts['distribution'] }} {{ ansible_facts['distribution_version'] }}

---
- name: Deploy motd
 hosts: all
 tasks:
 - name: Template motd
 ansible.builtin.template:
 src: motd.j2
 dest: /etc/motd
 owner: root
 group: root
 mode: "0644"

Task 5: Storage with a safety check

Task: On the db group, create a logical volume data of 1500 MiB in the volume group vg_db, format it as xfs and mount it at /data. If the volume group does not exist, print a message and continue. If the volume is too large for the group, print a different message.

---
- name: Storage
 hosts: db
 tasks:
 - name: Create logical volume
 block:
 - name: Create lv
 community.general.lvol:
 vg: vg_db
 lv: data
 size: 1500m
 rescue:
 - name: Report the failure
 ansible.builtin.debug:
 msg: "Could not create the volume. Check that vg_db exists and has space."

 - name: Create filesystem
 community.general.filesystem:
 fstype: xfs
 dev: /dev/vg_db/data
 ignore_errors: true

 - name: Mount filesystem
 ansible.posix.mount:
 path: /data
 src: /dev/vg_db/data
 fstype: xfs
 state: mounted
 ignore_errors: true

This task trains block, rescue and error handling. In a real exam, read exactly what message the task asks for, and print it exactly.

Task 6: Build a role

Task: Create a role named webserver that installs httpd, deploys an index.html template and has a handler to restart httpd when the file changes. Use the role in a playbook.

ansible-galaxy init roles/webserver

# roles/webserver/tasks/main.yml
---
- name: Install httpd
 ansible.builtin.dnf:
 name: httpd
 state: present

- name: Deploy index page
 ansible.builtin.template:
 src: index.html.j2
 dest: /var/www/html/index.html
 notify: Restart httpd

- name: Start httpd
 ansible.builtin.service:
 name: httpd
 state: started
 enabled: true

# roles/webserver/handlers/main.yml
---
- name: Restart httpd
 ansible.builtin.service:
 name: httpd
 state: restarted

# roles.yml
---
- name: Apply role
 hosts: web
 roles:
 - webserver

Also practise a requirements.yml file and installing roles with ansible-galaxy install -r requirements.yml -p roles.

Task 7: Schedule a job and set SELinux

Task: Add a cron job on all hosts that runs every day at 02:30, and make sure SELinux is enforcing.

---
- name: Cron and SELinux
 hosts: all
 tasks:
 - name: Add nightly job
 ansible.builtin.cron:
 name: nightly cleanup
 minute: "30"
 hour: "2"
 job: "/usr/bin/true"
 user: root

 - name: Set SELinux to enforcing
 ansible.posix.selinux:
 policy: targeted
 state: enforcing

What should you check before you finish any task?

• Does the playbook run twice with no changes the second time?
• Did you name the file exactly as the task says, and put it where it asks?
• Did you use privilege escalation where needed?
• Does the result survive a reboot, where the task implies it should? Services need enabled: true, mounts need an fstab entry, firewall rules need permanent: true.
• Did you run ansible-playbook --syntax-check and, where useful, --check?

Common mistakes

• Learning only ad-hoc commands. The exam is mostly playbooks and roles.
• Forgetting that a module name must be exact. Use ansible-doc and tab completion.
• Putting a vault password in the playbook. Use a password file as the task asks.
• Typing YAML with tabs. Use two spaces.
• Leaving the managed nodes in a state that does not survive a reboot.

Next steps

For structured practice with a lab, see WebAsha's RHCE EX294 course. If you want to go beyond EX294 into advanced automation, look at DO374 | EX374.

Related reading

• Ansible for Cybersecurity | Automating Security Tool Installation and Scans
• Latest RHCE EX294 Real Exam Questions & Answers for Guaranteed Success