RED HAT CERTIFIED ENGINEER (RHCE) –QUESTIONS AND CORRECT ANSWERS (VERIFIED
ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
Core Domains:- Ansible Architecture and Components- Playbook Deployment and Execution- System
Automation and Configuration Management- Network Automation and Device Configuration- Managing Security
and Compliance via Automation- Troubleshooting Ansible Invocations and Managed Nodes- Orchestrating
Advanced Tasks and Variables- Content Collections and Execution Environments
IntroductionThe Red Hat Certified Engineer (RHCE) examination validates the advanced skills, knowledge, and
abilities required to manage multiple systems using Red Hat Ansible Automation Platform. This assessment
gauges proficiency in automating system administration tasks, configuring network devices, and ensuring
enterprise-wide security compliance. Comprising a mix of complex multiple-choice items and scenario-based
problems, the exam evaluates an engineer’s capacity for critical thinking, real-world decision-making, and rapid
troubleshooting under production conditions. Candidates must demonstrate deep practical expertise in writing
reusable playbooks, managing execution environments, and maintaining industry compliance standards while
demonstrating adherence to professional and ethical IT automation practices.
Section One: Questions 1–100
Question 1
An administrator needs to write an Ansible playbook that ensures a specific enterprise application directory
exists with mode 0755, owned by the user 'deploy' and group 'deploy'. Which Ansible module is most
appropriate and compliant with the principle of idempotency for this task?
A. command
B. shell
C. file
D. copy
🟢 Correct answer: C
,🔴 RATIONALE: The 'file' module is specifically designed to manage file system attributes, directories, and
symlinks in an idempotent manner. Using 'command' or 'shell' would execute raw system commands, which
requires manual logic to achieve idempotency and violates best practices. The 'copy' module is used to transfer
files from the control node to managed nodes rather than solely manipulating directory metadata.
Question 2
A systems engineer is configuring an Ansible inventory file. To apply a specific variable named 'http_port=8080'
to a group of servers called [webservers], which of the following syntax structures is correct for an INI-formatted
inventory?
A. [webservers:vars]\nhttp_port=8080
B. [webservers]\nhttp_port=8080
C. [webservers:variables]\nhttp_port=8080
D. [webservers]\nvars: http_port=8080
🟢 Correct answer: A
🔴 RATIONALE: In an INI-formatted Ansible inventory file, group variables are defined by appending ':vars' to
the group name block. Options B and D use incorrect syntax that will cause parsing errors or fail to assign
variables to the entire group properly. Option C uses ':variables', which is not recognized by Ansible's inventory
parser.
Question 3
During a routine compliance audit, an RHCE discovers that an automated playbook exposes sensitive database
credentials in plain text within a task definition. Which Red Hat Ansible platform tool must be integrated to
encrypt these sensitive strings securely?
A. Ansible Galaxy
B. Ansible Vault
C. Ansible Lint
D. Ansible Navigator
🟢 Correct answer: B
,🔴 RATIONALE: Ansible Vault provides symmetric encryption for variables, files, and entire playbooks,
ensuring sensitive data like credentials remain secure. Ansible Galaxy is a repository for sharing roles and
collections. Ansible Lint analyzes playbooks for syntax and style violations. Ansible Navigator is a command-
line utility for running and inspecting playbooks.
Question 4
A production environment requires that a configuration task execute only if the target managed node is running
a Red Hat Enterprise Linux (RHEL) operating system. Which Ansible conditional statement evaluates this
requirement accurately using setup facts?
A. when: ansible_os_family == "RedHat"
B. when: os_type == "RHEL"
C. check: ansible_distribution == "RedHat"
D. when: ansible_fact_distribution == "RHEL"
🟢 Correct answer: A
🔴 RATIONALE: Ansible gathers facts automatically, including 'ansible_os_family'. For RHEL systems, this fact
is set to "RedHat". Option B uses an undefined variable name. Option C uses an incorrect keyword ('check'
instead of 'when'). Option D uses incorrect fact naming conventions.
Question 5
An operations team must enforce regulatory compliance by ensuring that the root password on all managed
servers is updated monthly. Which built-in Ansible module should be leveraged within a playbook to safely
modify user password hashes?
A. user
B. lineinfile
C. shadow
D. command
🟢 Correct answer: A
, 🔴 RATIONALE: The 'user' module provides a native, secure, and idempotent way to manage user accounts,
including setting password hashes via the 'password' parameter. Using 'lineinfile' or 'command' to edit
/etc/shadow directly introduces parsing risks and lacks native validation, violating safety and professional
standards. There is no 'shadow' module for this specific operational task.
Question 6
An engineer executes a playbook and notices that a handler failed to trigger even though the task notifying it
reported a state change of 'changed'. What is the most likely structural reason for this issue?
A. The handler name does not exactly match the notify string.
B. Handlers can only be notified by tasks within the same role.
C. The playbook was executed using the '--check' flag.
D. Handlers execute automatically at the start of a play.
🟢 Correct answer: A
🔴 RATIONALE: Ansible maps notifications to handlers by exact string matching. If there is a typo, casing
difference, or spacing mismatch between the 'notify' directive and the handler's 'name', the handler will not
trigger. Handlers run at the end of the play by default if notified, and '--check' mode would still simulate
notifications.
Question 7
When designing reusable automation assets for a global enterprise, an engineer wants to bundle tasks,
variables, handlers, and default settings into a standardized structure. What structural component should be
created?
A. A dynamic inventory script
B. An Ansible role
C. An Ansible task block
D. A custom filter plugin
🟢 Correct answer: B
ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
Core Domains:- Ansible Architecture and Components- Playbook Deployment and Execution- System
Automation and Configuration Management- Network Automation and Device Configuration- Managing Security
and Compliance via Automation- Troubleshooting Ansible Invocations and Managed Nodes- Orchestrating
Advanced Tasks and Variables- Content Collections and Execution Environments
IntroductionThe Red Hat Certified Engineer (RHCE) examination validates the advanced skills, knowledge, and
abilities required to manage multiple systems using Red Hat Ansible Automation Platform. This assessment
gauges proficiency in automating system administration tasks, configuring network devices, and ensuring
enterprise-wide security compliance. Comprising a mix of complex multiple-choice items and scenario-based
problems, the exam evaluates an engineer’s capacity for critical thinking, real-world decision-making, and rapid
troubleshooting under production conditions. Candidates must demonstrate deep practical expertise in writing
reusable playbooks, managing execution environments, and maintaining industry compliance standards while
demonstrating adherence to professional and ethical IT automation practices.
Section One: Questions 1–100
Question 1
An administrator needs to write an Ansible playbook that ensures a specific enterprise application directory
exists with mode 0755, owned by the user 'deploy' and group 'deploy'. Which Ansible module is most
appropriate and compliant with the principle of idempotency for this task?
A. command
B. shell
C. file
D. copy
🟢 Correct answer: C
,🔴 RATIONALE: The 'file' module is specifically designed to manage file system attributes, directories, and
symlinks in an idempotent manner. Using 'command' or 'shell' would execute raw system commands, which
requires manual logic to achieve idempotency and violates best practices. The 'copy' module is used to transfer
files from the control node to managed nodes rather than solely manipulating directory metadata.
Question 2
A systems engineer is configuring an Ansible inventory file. To apply a specific variable named 'http_port=8080'
to a group of servers called [webservers], which of the following syntax structures is correct for an INI-formatted
inventory?
A. [webservers:vars]\nhttp_port=8080
B. [webservers]\nhttp_port=8080
C. [webservers:variables]\nhttp_port=8080
D. [webservers]\nvars: http_port=8080
🟢 Correct answer: A
🔴 RATIONALE: In an INI-formatted Ansible inventory file, group variables are defined by appending ':vars' to
the group name block. Options B and D use incorrect syntax that will cause parsing errors or fail to assign
variables to the entire group properly. Option C uses ':variables', which is not recognized by Ansible's inventory
parser.
Question 3
During a routine compliance audit, an RHCE discovers that an automated playbook exposes sensitive database
credentials in plain text within a task definition. Which Red Hat Ansible platform tool must be integrated to
encrypt these sensitive strings securely?
A. Ansible Galaxy
B. Ansible Vault
C. Ansible Lint
D. Ansible Navigator
🟢 Correct answer: B
,🔴 RATIONALE: Ansible Vault provides symmetric encryption for variables, files, and entire playbooks,
ensuring sensitive data like credentials remain secure. Ansible Galaxy is a repository for sharing roles and
collections. Ansible Lint analyzes playbooks for syntax and style violations. Ansible Navigator is a command-
line utility for running and inspecting playbooks.
Question 4
A production environment requires that a configuration task execute only if the target managed node is running
a Red Hat Enterprise Linux (RHEL) operating system. Which Ansible conditional statement evaluates this
requirement accurately using setup facts?
A. when: ansible_os_family == "RedHat"
B. when: os_type == "RHEL"
C. check: ansible_distribution == "RedHat"
D. when: ansible_fact_distribution == "RHEL"
🟢 Correct answer: A
🔴 RATIONALE: Ansible gathers facts automatically, including 'ansible_os_family'. For RHEL systems, this fact
is set to "RedHat". Option B uses an undefined variable name. Option C uses an incorrect keyword ('check'
instead of 'when'). Option D uses incorrect fact naming conventions.
Question 5
An operations team must enforce regulatory compliance by ensuring that the root password on all managed
servers is updated monthly. Which built-in Ansible module should be leveraged within a playbook to safely
modify user password hashes?
A. user
B. lineinfile
C. shadow
D. command
🟢 Correct answer: A
, 🔴 RATIONALE: The 'user' module provides a native, secure, and idempotent way to manage user accounts,
including setting password hashes via the 'password' parameter. Using 'lineinfile' or 'command' to edit
/etc/shadow directly introduces parsing risks and lacks native validation, violating safety and professional
standards. There is no 'shadow' module for this specific operational task.
Question 6
An engineer executes a playbook and notices that a handler failed to trigger even though the task notifying it
reported a state change of 'changed'. What is the most likely structural reason for this issue?
A. The handler name does not exactly match the notify string.
B. Handlers can only be notified by tasks within the same role.
C. The playbook was executed using the '--check' flag.
D. Handlers execute automatically at the start of a play.
🟢 Correct answer: A
🔴 RATIONALE: Ansible maps notifications to handlers by exact string matching. If there is a typo, casing
difference, or spacing mismatch between the 'notify' directive and the handler's 'name', the handler will not
trigger. Handlers run at the end of the play by default if notified, and '--check' mode would still simulate
notifications.
Question 7
When designing reusable automation assets for a global enterprise, an engineer wants to bundle tasks,
variables, handlers, and default settings into a standardized structure. What structural component should be
created?
A. A dynamic inventory script
B. An Ansible role
C. An Ansible task block
D. A custom filter plugin
🟢 Correct answer: B
