RHCE Mock Exam 1

Full EX294-style mock exam. You start on a bare control node: no `~/ansible/ansible.cfg`, no inventory, no keys. The managed nodes are freshly installed (only the `devops` account, password `devops`). The provided files are `~/ansible/user_list.yml`, `~/ansible/hosts.j2` and the vault file `~/ansible/salaries.yml`. Exam rules (as on EX294): 4 hours; you work as `student` on control; every playbook lives in `/home/student/ansible` and must run with `ansible-navigator run` (or ansible-playbook) from there; the nodes are only managed through Ansible after the initial access setup (root password on the nodes: `redhat`, the `devops` password is `devops`); docs are local only (`ansible-doc`, `ansible-navigator doc`, `/usr/share/doc/rhel-system-roles`). Tasks are marked on the end state of the nodes and files, and the grader re-runs your playbooks, so they must be idempotent. Lab notes: web nodes run SELinux permissive at runtime here; collection tarballs are at `http://utility/collections/`, role tarballs at `http://utility/roles/`.

Tasks

  1. Install and configure Ansible on control. ansible-navigator is installed. Create ~/ansible/inventory with the groups: dev = node1; test = node2; prod = node3; balancers = node4; and webservers whose child group is prod. Create ~/ansible/ansible.cfg: that inventory, remote user devops, privilege escalation with sudo by default (no password prompt), roles path ~/ansible/roles (plus /usr/share/ansible/roles), collections path ~/ansible/collections (plus /usr/share/ansible/collections). Create ~/ansible/ansible-navigator.yml using the image utility.lab.example.com/ee-supported-rhel10:latest, pull policy never, mode stdout.
  2. Generate an SSH key pair for student and copy it to devops on all four nodes; on every node devops may run any command with sudo without a password (file in /etc/sudoers.d). ansible all -m ping must succeed.
  3. Create the executable shell script ~/ansible/adhoc.sh that uses ad-hoc Ansible commands (module yumrepository) to configure two repositories on all managed nodes, then run it: - EX294BASE: description EX294 base software, baseurl https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi10/10/x8664/baseos/os - EX294STREAM: description EX294 stream software, baseurl https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi10/10/x8664/appstream/os Both with GPG checking enabled, gpgkey file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release, and enabled.
  4. Create ~/ansible/collections/requirements.yml that installs these collections from http://utility/collections/ and install them into ~/ansible/collections: ansible.posix, community.general.
  5. Create ~/ansible/roles/requirements.yml and use it to install into ~/ansible/roles: the role http://utility/roles/balancer.tar.gz under the name balancer, and http://utility/roles/phpinfo.tar.gz under the name phpinfo.
  6. Create your own role apache in ~/ansible/roles: it installs and starts (and enables) httpd and firewalld, allows the http service in firewalld (permanent and running), and deploys /var/www/html/index.html from a template with the content Welcome to node3.lab.example.com on 172.18.0.5. Apply it to the webservers group with ~/ansible/apache.yml.
  7. Write ~/ansible/roles.yml that applies the installed roles: phpinfo on webservers and balancer on balancers. Afterwards curl http://node4/hello.php from control must show Hello PHP World from <a webserver followed by the PHP info page.
  8. Write ~/ansible/timesync.yml that uses the RHEL system role redhat.rhelsystemroles.timesync so that all managed nodes synchronise time with utility.lab.example.com using iburst.
  9. Write ~/ansible/packages.yml: install tmux on dev; install zsh on test; install vsftpd on prod — only on those groups.
  10. Write ~/ansible/lv.yml for all nodes: create the logical volume data of 1500 MiB in volume group research. If the VG is too small, print Could not create a logical volume of that size and create it with 800 MiB instead. If the VG does not exist, print Volume group does not exist. Format the LV with ext4. Do not create anything on hosts without the VG.
  11. Complete the provided template ~/ansible/hosts.j2 (keep its first lines) so that it adds one line per managed node: <IPv4 address <FQDN <short hostname. Write ~/ansible/hosts.yml that generates /etc/myhosts from it on the dev hosts only.
  12. Write ~/ansible/issue.yml that replaces the content of /etc/issue: on dev with Development, on test with Test, on prod with Production (single line each).
  13. Write ~/ansible/webcontent.yml for dev: group webdev; directory /webdev owned by group webdev with mode 2775 (setgid); /webdev/index.html containing Development; a symbolic link /var/www/html/webdev → /webdev; the SELinux type httpdsyscontentt on the directory and its content, persistently.
  14. Write ~/ansible/hwreport.yml that downloads http://utility/hwreport.empty to /root/hwreport.txt on all nodes and fills in each line: HOST = inventory hostname, MEMORY = total memory in MB, BIOS = BIOS version, DISKSIZEVDA = size of disk vda, DISKSIZEVDB = size of disk vdb. Use NONE for any value a host does not have (e.g. a missing disk).
  15. Create the vault password file ~/ansible/secret.txt containing whenyouwish294 and the vault-encrypted ~/ansible/locker.yml defining pwdeveloper: Imadev294 and pwmanager: Imamgr294. Write ~/ansible/users.yml using the provided ~/ansible/userlist.yml: users whose job is developer exist on dev and test with their uid, supplementary group devteam and password pwdeveloper; users whose job is manager exist on prod with group opsmgr and password pwmanager. Passwords are SHA-512 hashes.
  16. Rekey the provided vault file ~/ansible/salaries.yml (current password oldvault294) to the new password Rekey2026x.
  17. Write ~/ansible/cron.yml: on all nodes, a cron job named exam log for user devops that runs logger "EX294 in progress" every 2 minutes.
  18. Make sure your playbooks are idempotent: running issue.yml and webcontent.yml again must report changed=0 and no failures. (The grader re-runs every playbook.)