Red Hat Certified Engineer (RHCE) interview questions

It connects over SSH (or WinRM for Windows) and runs modules with Python on the target, so there is no agent to install, patch or monitor. Onboarding a server only needs SSH access and a user with sudo, which is why it fits existing estates well.

What they are checking: Understanding of how Ansible reaches hosts.

Likely follow-up: What do you need on a managed node for Ansible to work?

Running the same playbook again makes no further changes once the system is in the desired state, and reports "ok" instead of "changed". You break it by using command or shell modules without creates, removes or changed_when, so they run and report changed every time. Prefer purpose-built modules.

What they are checking: You write repeatable automation.

Likely follow-up: How do you make a shell task idempotent?

Playbooks map hosts to what they should be; roles package reusable pieces (tasks, handlers, templates, defaults) such as a web server or hardening role. Keep variables in group_vars and host_vars, pull shared roles and collections from a requirements file, and keep it all in Git.

What they are checking: Structure that a team can maintain.

Likely follow-up: What is the difference between defaults and vars in a role?

Ansible Vault to encrypt variable files or single values, with the vault password from a protected file or a secrets manager, never committed. In Automation Controller use credentials so users run jobs without seeing the secret.

What they are checking: Safe secret handling.

Likely follow-up: How do you use different vault passwords for dev and prod?

Run with -vvv to see the module arguments and output, use --check and --diff, and compare facts between the two hosts (ansible -m setup). Differences are usually packages, repositories, SELinux, a missing user or a different Python. Add asserts so the playbook fails early with a clear message.

What they are checking: Using facts and verbosity methodically.

Likely follow-up: How do you run just one task to test it?

When the whole file depends on variables or facts, such as a config per host or environment. lineinfile is fine for a single line but gets fragile for many edits; a template makes the file fully managed and reviewable. Add a validate command (e.g. nginx -t) before it is put in place.

What they are checking: Choosing the right module.

Likely follow-up: How do you restart a service only when its template changes?

Use serial to do batches (for example 10% at a time), max_fail_percentage to stop if too many fail, take each host out of the load balancer before patching and add it back after a health check, and reboot only when needed with the reboot module. Run it first on a test group.

What they are checking: Rolling updates and safety stops.

Likely follow-up: What does serial combined with max_fail_percentage do?

journalctl -u for the error, then SELinux: a non-standard port needs semanage port -a with the right type, otherwise the bind is denied (check with ausearch or the audit log). Then firewalld for the new port, and whether something else already listens (ss -tlnp).

What they are checking: SELinux awareness, a classic RHCE topic.

Likely follow-up: How do you find which SELinux type a port needs?

A web UI and API (Automation Controller) with role-based access, credentials, job templates, schedules, surveys, logging and workflows, plus private automation hub for approved collections and execution environments for consistent runtimes. Teams can run approved jobs without shell access.

What they are checking: Thinking about automation for a whole team.

Likely follow-up: What is an execution environment?

Give a real example with numbers: the manual task, how long it took, what you wrote, and the result (hours saved per month, fewer errors). Mention how you tested it and handed it over so others could run it.

What they are checking: Measurable impact and teamwork.

Likely follow-up: How did you get others to trust the automation?