Red Hat Certified Specialist in Ansible Automation

The certifications page covers this exam in a couple of paragraphs alongside the rest of the field. This page is the deep profile: what Red Hat actually hands you on exam day, the exam-code rename that trips up anyone studying from an old guide, the objective areas the tasks are drawn from, the RHCSA→RHCE→RHCA ladder this credential sits on, and a direct map onto the two lessons here that already teach the substance — the Ansible tool page for the mechanics the exam tests directly, and configuration management for the vendor-neutral model underneath it. If your organization has standardized on Ansible for configuration management, this is the credential that proves you can operate it under a clock, on a real machine, not just describe it in an interview.

What the exam is, and who it's for

☺ Like you're 10: A hands-on, timed test on a real Red Hat Linux machine — you write actual Ansible content to fix and configure it, and a script checks the machine's end state afterward, not your typing.

The Red Hat Certified Specialist in Ansible Automation is Red Hat's own credential for demonstrating you can use Ansible to automate real Red Hat Enterprise Linux administration at a practitioner level. Like every Red Hat certification, it is 100% performance-based — there is no multiple-choice section at all. You are given remote access to a set of live RHEL systems and a list of tasks — install and configure software, manage users and storage, open a firewall port, enforce an SELinux policy — and told to accomplish them using Ansible. Grading happens afterward, against the resulting state of the machines, the same philosophy this course's own CKA profile already covers for Kubernetes: nobody reads your playbook for style, and an answer you didn't verify with a second command is an answer you don't actually have yet.

It targets systems administrators and automation engineers who already work inside the Red Hat ecosystem — RHEL day to day, Ansible as the configuration-management layer on top of it — and want that specific combination externally validated. It is not a general Ansible credential platform-agnostic of the underlying OS, and it is not a beginner's first exposure to either RHEL or Ansible; Red Hat's own course prerequisites assume you can already drive a RHEL shell competently before automation enters the picture.

↗ Red Hat's certification catalog

Which exam, exactly? EX407, EX374, and the Ansible Automation Platform shift

☺ Like you're 10: The name on the certificate has stayed roughly the same, but the exam code and the underlying software it tests have moved — twice — so an old study guide might be testing a tool that's no longer what you'll actually use.

For years the credential this page is about was sat under exam code EX407, built on RHEL and the then-current open-source Ansible engine. As Red Hat's product line consolidated around Ansible Automation Platform (AAP) — the commercial bundle covering Automation controller (the modern name for what used to ship as Ansible Tower/AWX's downstream product), execution environments, and a private content hub — the exam moved with it. Depending on when you're reading this, the live exam code may be EX374 (Red Hat Certified Specialist in Ansible Automation Platform), testing AAP-era concepts — Automation controller job templates, execution environments, and credentials managed through the platform's own RBAC — layered on top of the same playbook-and-role fundamentals EX407 always tested. Treat the exam code itself as the single fastest way to tell whether a piece of study material is current.

What you actually have to do: the objective areas

☺ Like you're 10: Unlike some other exams, Red Hat doesn't publish a "this topic is worth 30%" breakdown here — just a list of things you need to be able to do, and the exam mixes tasks from across that list.

Red Hat does not publish per-topic percentage weights for this exam the way the CNCF does for the CKA curriculum — there is no "30% troubleshooting" equivalent to point at. What Red Hat does publish is an objectives list on the exam's own certification page; the areas below are a study-oriented paraphrase of that list's long-standing shape, not a verbatim quote, and should be checked against the current published objectives for whichever exam code you're actually registered for.

1. Install and configure an Ansible control node — ansible.cfg precedence, SSH connectivity and privilege escalation to managed nodes, and (on the AAP-era exam) basic Automation controller setup.
2. Build and maintain inventories — static INI/YAML inventories, host and group variables, nested groups, and group/host precedence rules.
3. Write playbooks that manage RHEL systems — packages via dnf, services via systemd, users and groups, cron, storage, and files, using purpose-built modules rather than raw shell/command escape hatches.
4. Manage SELinux and firewalld through Ansible — SELinux booleans and file contexts, and firewalld zones, services, and ports, both idempotently through modules rather than one-off shell invocations.
5. Author and reuse roles — the standard role directory layout, installing and pinning content from Ansible Galaxy or a private Automation Hub, and using Red Hat's own RHEL System Roles collection.
6. Template configuration with Jinja2 — rendering per-host config files from variables and facts, the same templating layer covered on the Ansible tool page.
7. Protect sensitive data with Ansible Vault — encrypting variables and whole files, and running a vault-protected playbook non-interactively with a password file.
8. Control execution flow — conditionals, loops, blocks and error handling (rescue/always), tags, and handlers.
9. Troubleshoot playbooks under time pressure — reading task output, -v/-vvv verbosity, --check/--diff, and the ansible.builtin.debug module to inspect a variable mid-run.

One specific, real detail worth knowing before you study: Red Hat ships RHEL System Roles as an officially maintained collection (redhat.rhel_system_roles, also packaged as the rhel-system-roles RPM) covering common sysadmin domains — networking, storage, SELinux, firewall, time synchronization, kernel tuning — as pre-built, tested roles. The exam rewards knowing these exist and how to call one correctly over hand-rolling the equivalent logic from scratch under time pressure.

# A RHEL-flavored task list typical of this exam's style —
# firewalld and SELinux managed idempotently, not shelled out to
- name: Harden and expose the web tier
  hosts: web
  become: true
  tasks:
    - name: Ensure httpd is installed
      ansible.builtin.dnf:
        name: httpd
        state: present

    - name: Open the http service in the public firewalld zone
      ansible.posix.firewalld:
        service: http
        zone: public
        permanent: true
        immediate: true
        state: enabled

    - name: Allow httpd to bind non-standard ports via an SELinux boolean
      ansible.posix.seboolean:
        name: httpd_can_network_connect
        state: true
        persistent: true

    - name: Ensure httpd is running and enabled
      ansible.builtin.systemd:
        name: httpd
        state: started
        enabled: true

None of that is exotic Ansible — it's the same task-idempotency contract covered in full on the Ansible tool page, just aimed specifically at the RHEL modules (ansible.builtin.dnf, ansible.posix.firewalld, ansible.posix.seboolean) this exam actually exercises.

Performance-based, graded like the CKA — not like the Terraform Associate

☺ Like you're 10: Some certifications ask you questions about a tool; this one, like the CKA, hands you the tool and a broken machine and watches what you actually do with it.

This course already profiles two other certifications that sit at opposite ends of the same "how is it graded" spectrum, and it's worth being explicit about where this one lands. The Terraform Associate is entirely knowledge-based — multiple choice, closed-book, no terminal touched. The CKA is entirely performance-based — live clusters, graded on end state. The Red Hat Ansible Automation exam sits with the CKA, not the Terraform Associate: everything is done on a real machine, and everything is graded on whether the machine ended up in the state the task asked for.

The practical consequence is the same one the CKA profile already names: speed and verification are real, tested skills here, not incidental. An Ansible task you completed but never re-ran to confirm it actually converged is a task you have not finished, and the clock does not pause while you double-check.

How this fits DevOps configuration-management practice

☺ Like you're 10: This exam checks the exact skill this course calls "configuration management" — making a server's actual state match a version-controlled definition — just using Red Hat's specific stack to check it.

This course draws a clean boundary on infrastructure as code and configuration management: provisioning makes a resource exist, configuration management makes what's running on it match a declared, version-controlled definition, and keeps it there. This exam is a direct, hands-on check of the second half of that boundary, using the same agentless, SSH-based, idempotent-by-design tool this course covers in full depth on its own Ansible tool page — inventory, playbooks, roles, idempotency mechanics, Vault, the whole shape. If you've worked through that page and the configuration management lesson underneath it, the fundamentals section of this exam is not new material — it's the same content under exam pressure, aimed specifically at RHEL rather than a generic target OS.

The one genuinely exam-specific gap most Ansible-fluent engineers have is Vault key discipline and RHEL-specific modules — firewalld, seboolean, selinux — which don't come up nearly as often on a mixed-OS fleet as they do when every managed node is guaranteed to be RHEL. Secrets & Credential Management covers the Vault half in more general terms; the RHEL-module half is best closed by practicing against a real RHEL VM rather than reading about it.

Where it sits: RHCSA → RHCE → five Specialist exams → RHCA

☺ Like you're 10: It's one rung on a ladder, not the whole ladder — and unlike the rungs below it, you get to pick which specialist rungs you climb.

RHCSA (Red Hat Certified System Administrator) is the foundation — core RHEL administration, no automation required. RHCE (EX294, "Red Hat Enterprise Linux Automation with Ansible") requires a currently active RHCSA and is itself already an Ansible-heavy exam, just scoped to standard day-to-day sysadmin tasks. RHCA (Red Hat Certified Architect) sits above both: it requires a currently active RHCE plus any five Red Hat Certified Specialist exams from Red Hat's approved list — Security: Linux, Red Hat Satellite, High Availability Clustering, and several others alongside this one. The Ansible Automation specialist exam is a genuinely popular pick for one of those five, precisely because most RHCE holders are already halfway fluent in Ansible by the time they've passed EX294 — but it is a choice among options, not a mandatory checkpoint on the way to RHCA.

Who should sit it — and who should skip it

☺ Like you're 10: Great if your servers are RHEL and your automation is Ansible; a detour if either of those isn't true for you.

Take it if your organization has standardized on RHEL, RHEL-derivative distributions, or Ansible Automation Platform specifically, and you want that exact combination of skills externally validated — this is a strong differentiator in Red-Hat-shops' hiring pipelines precisely because it's hands-on and can't be memorized from a dump the way a knowledge-based exam can be. It's also a natural next step after RHCE if you're building toward RHCA and want a specialist exam that reuses skills you likely already have.

Consider skipping it if your fleet is mixed-OS or not RHEL-centric at all — the RHEL-specific modules this exam leans on (firewalld, SELinux booleans, dnf) won't transfer to a Debian/Ubuntu or Windows-heavy estate the way general Ansible fundamentals would; a broader, OS-agnostic proof point is better served by hands-on portfolio work than by this specific credential. It's also a poor first certification if you haven't sat an entry-level Linux credential or RHCSA yet — Red Hat's own guidance assumes that foundation is already solid, and the exam will not pause to teach it to you. And if Ansible itself, rather than RHEL specifically, is the skill gap, general fluency is better built first with the Ansible tool page and the hands-on infrastructure-as-code capstone before spending exam fees on a RHEL-flavored version of it.

Exam logistics — verify these yourself before you register

☺ Like you're 10: Exam codes, prices, and formats are exactly the kind of thing that changes without much warning — read the vendor's own page the week you actually plan to book.