CV0-004 Troubleshooting Practice Test 3 — 15 Questions

Question 1

An organization has a site-to-site VPN connection between its on-premises network and a cloud VPC. Users report intermittent connectivity to applications hosted in the cloud. The administrator checks the VPN tunnel status and sees it is up. However, ping tests from on-premises to a cloud instance fail at random times. Which factor should the administrator investigate first?

Accepted Answer

The VPN tunnel is experiencing packet loss due to a mismatch in the IPSec parameters.. Option C is correct because intermittent connectivity despite tunnel being up suggests packet loss or misconfiguration in IPSec (e.g., mismatched phase 2 parameters). Option A is wrong because routes would cause complete failure. Option B is wrong but could cause failure; however, it's intermittent. Option D is wrong because it would cause consistent failure.

Answer

The on-premises firewall is blocking outbound ICMP.

Answer

The security group on the cloud instance is blocking ICMP.

Answer

The routing tables on the cloud VPC are missing routes for the on-premises network.

Question 2

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

Accepted Answer

Migrate to a volume type with provisioned IOPS (SSD).. Option B is correct because standard HDD has limited burst IOPS, and sustained writes will degrade; provisioned IOPS SSD provides consistent performance. Option A is wrong because increasing HDD size increases baseline IOPS but still limited and burst-based. Option C is wrong because write caching on a data volume is not recommended and may cause data loss. Option D is wrong because object storage is not block-level and may require application changes.

Answer

Increase the volume size to gain higher baseline IOPS.

Answer

Move the logs to an object storage service.

Answer

Enable write caching on the volume.

Question 3

A company uses a cloud provider's IAM service to manage access. An administrator creates a new IAM role for an application running on an EC2 instance to access an S3 bucket. The application is unable to read objects from the bucket, even though the role has an attached policy that allows s3:GetObject on the bucket. The administrator verifies that the instance is correctly associated with the role. What is the most likely cause?

Accepted Answer

The role's permissions policy has a condition key that restricts access to a specific IP range.. Option D is correct because a condition (e.g., ipAddress) could restrict access if the instance's IP is not in the allowed range. Option A is wrong but plausible; bucket policy could deny, but the stem doesn't indicate that. Option B is wrong because if the trust policy were wrong, the instance wouldn't get the role credentials. Option C is wrong because S3 uses HTTPS, and security groups outbound all is default.

Answer

The S3 bucket policy denies access to the role.

Answer

The role's trust policy does not allow the EC2 service to assume the role.

Answer

The instance's security group is blocking outbound traffic to S3.

Question 4

A web application is deployed across multiple availability zones behind an application load balancer (ALB). The administrator notices that all traffic is being routed to instances in only one availability zone, causing performance issues. The ALB cross-zone load balancing is enabled. What is the most likely cause?

Accepted Answer

The instances in the other zones are marked as unhealthy due to failing health checks.. Option A is correct because if health checks fail, instances are deregistered, and ALB only sends traffic to healthy targets. Option B is wrong because a single target group can have instances from multiple zones. Option C is wrong because security groups are not zone-specific. Option D is wrong because route tables affect instance outbound, not ALB traffic distribution.

Answer

The security group for the ALB only allows traffic from one zone.

Answer

The route table for the subnets in the other zones is missing a default route.

Answer

The listener rules are configured to forward traffic to a single target group.

Question 5

A cloud administrator is troubleshooting a virtual machine that is experiencing high memory usage. The VM is running a web server. Which two metrics should the administrator monitor to determine if the VM needs additional memory? (Choose two.)

Accepted Answer

Swap usage. Options A and C are correct. Available memory directly shows free memory, and swap usage indicates the OS is using disk as memory, which is a sign of insufficient RAM. Option B (CPU ready time) is a CPU metric. Option D (disk I/O wait) is disk-related. Option E (page fault rate) indicates paging but is not as direct as swap usage.

Answer

Disk I/O wait

Answer

Page fault rate

Answer

CPU ready time

Question 6

A company's application is unable to connect to a managed cloud database. The database is deployed in a VPC with public accessibility disabled. The application runs on an EC2 instance in the same VPC. Which three troubleshooting steps should the administrator take? (Choose three.)

Accepted Answer

Check the network ACL associated with the database subnet for appropriate rules.. Options B, C, and E are correct. Option A is wrong because a public IP is not needed for same VPC communication. Option D is wrong because an internet gateway is not needed for internal traffic. B checks security group inbound, C verifies the endpoint configuration, and E checks network ACLs.

Answer

Ensure the VPC has an internet gateway attached.

Answer

Verify that the EC2 instance has a public IP address.

Question 7

A cloud administrator is troubleshooting performance issues with a cloud object storage bucket that is used for storing large amounts of small files. The application reads and writes objects frequently. Which three actions could improve the performance? (Choose three.)

Accepted Answer

Increase the number of concurrent requests from the application.. Options C, D, and E are correct. Option A is wrong because multi-region buckets increase write latency due to replication. Option B is wrong because versioning adds overhead. C uses prefix naming to increase request rate, D uses transfer acceleration for faster uploads, and E increases throughput via concurrency.

Answer

Use a multi-region bucket to reduce latency.

Answer

Enable versioning to avoid overwrites.

Question 8

The exhibit shows the output of the df command and an application error. What is the most likely cause of the error?

Accepted Answer

The /var partition is full.. Option A is correct because the root partition is at 95% usage, and the application writes to /var/log which is on the root filesystem. Option B is wrong because tmpfs is empty. Option C is plausible but df shows space, not inodes; inode exhaustion would also give same error, but more likely space. Option D is wrong because no corruption indicated.

Answer

The /dev/shm partition is full.

Answer

The filesystem is corrupt.

Answer

The inode usage on the root filesystem is exhausted.

Question 9

The exhibit shows the health check status for targets in an application load balancer's target group. The target group has a health check on port 80. An administrator notices that one target is unhealthy on port 80 but healthy on port 443. What is the most likely cause?

Accepted Answer

The security group for the target is blocking port 80 from the load balancer.. Option A is correct because the target is healthy on 443 but not on 80, suggesting port 80 is blocked. Option B is wrong because it's healthy on 443, so server is listening. Option C is wrong because if path were wrong, both would fail. Option D is wrong because the same target group is used.

Answer

The web server on the target is not listening on port 443.

Answer

The load balancer is in a different VPC.

Answer

The health check path is incorrect.

Question 10

The exhibit shows VPC flow log entries for an EC2 instance (eni-12345678). The administrator is troubleshooting a connectivity problem where an application on 10.0.1.5 occasionally cannot connect to a web server at 10.0.2.10 on port 80. What action should the administrator take?

Accepted Answer

Add a network ACL rule allowing inbound TCP/80 from 10.0.1.5 to the subnet of 10.0.2.10.. Option B is correct because the REJECT entry indicates that traffic is being blocked by a stateless firewall (NACL) because security groups are stateful and would not generate REJECT at network level. The REJECT is from a NACL. Adding an inbound allow rule in NACL for the target subnet would fix it. Option A is wrong because security groups are stateful and allow return traffic; the initial connection may be allowed but not specified; but flow logs show REJECT which is typical from NACL. Option C is wrong because routes are for routing, not filtering. Option D is wrong because MTU doesn't cause reject.

Answer

Increase the MTU on the instance to 9001.

Answer

Add a security group rule allowing inbound TCP/80 from 10.0.1.5.

Answer

Add a route to the VPC route table for 10.0.1.5.

Question 11

A cloud administrator notices that a virtual machine is unresponsive. The VM is running on a hypervisor host that shows high CPU utilization. What should the administrator do first?

Accepted Answer

Check the VM console for OS-level issues. Option C is correct because the first step in troubleshooting an unresponsive VM is to check the VM console for OS-level issues. Option A is wrong because migrating the VM might be premature without diagnosing the root cause. Option B is wrong because increasing vCPU could exacerbate resource contention if the host is overloaded. Option D is wrong because rebooting the host would affect all VMs and should be a last resort.

Answer

Reboot the hypervisor host

Answer

Increase the VM's vCPU count

Answer

Migrate the VM to another host

Question 12

A company is experiencing intermittent network connectivity issues between two cloud subnets. The cloud provider's monitoring shows no packet loss. Which troubleshooting step should be taken first?

Accepted Answer

Review the security group rules for both subnets. Option B is correct because security group rules can cause intermittent connectivity issues by selectively dropping traffic. Option A is wrong because virtual routers are typically managed by the provider and are unlikely to cause issues without alerts. Option C is wrong because physical cabling is not relevant in the cloud. Option D is wrong because increasing bandwidth does not address the underlying cause of intermittent drops.

Answer

Replace the virtual routers

Answer

Increase the bandwidth between subnets

Answer

Check the physical cabling

Question 13

An administrator deployed a new web application using an auto-scaling group. Users report that the application becomes slow after a few hours. The administrator examines the scaling policy and notices that the CPU utilization threshold is set to 80% for scale-out and 20% for scale-in. What is the most likely issue?

Accepted Answer

The scale-out threshold is too high, causing delayed scaling. Option B is correct because a scale-out threshold of 80% delays the addition of new instances, causing performance degradation. Option A is wrong because a 20% scale-in threshold is low, but not the primary cause of slowness. Option C is wrong because the symptoms point to scaling configuration rather than a memory leak. Option D is wrong because load balancer misconfiguration would likely cause direct failures, not gradual slowdown.

Answer

The scale-in threshold is too low, causing instances to be terminated prematurely

Answer

The load balancer is misconfigured

Answer

The application has a memory leak

Question 14

A cloud administrator is troubleshooting a failed backup job that was supposed to back up a database to a cloud storage bucket. The job fails with an access denied error. Which two likely causes should the administrator investigate? (Choose two.)

Accepted Answer

The IAM role assigned to the backup service lacks write permissions to the bucket. Correct options are B and C. Option B is likely because missing IAM permissions cause access denied. Option C is likely because a deleted bucket would also produce an access denied error. Option A is wrong because version incompatibility would cause a different error. Option D is wrong because an offline database would cause a connection error, not access denied. Option E is wrong because schedule misconfiguration would prevent the job from running, not cause access denied.

Answer

The database is offline during backup

Answer

The backup schedule is misconfigured

Answer

The backup software version is incompatible

Question 15

An organization is migrating workloads to the cloud and after migration, users complain about slow application response times. The administrator reviews the cloud provider's dashboard and sees no resource bottlenecks. Which three factors could still cause poor performance? (Choose three.)

Accepted Answer

DNS resolution delays due to on-premises DNS server. Correct options are A, B, and D. Option A is correct because DNS delays can increase response times without showing as resource usage. Option B is correct because TCP window scaling mismatch can degrade network throughput transparently. Option D is correct because geographic latency is not a resource bottleneck. Option C is wrong because insufficient CPU cores would appear as a CPU bottleneck on the dashboard. Option E is wrong because application optimization issues would typically manifest as high resource usage.

Answer

The application is not optimized for the cloud infrastructure

Answer

Insufficient number of CPU cores in the VM