CV0-004 Troubleshooting Practice Test 3 — 15 Questions

Question 1

A cloud administrator manages a web application that uses an auto scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The CPU utilization for the ASG averages 40%. However, during peak hours, users experience intermittent timeouts. The administrator reviews the scaling policy, which is set to scale out when CPU exceeds 70% for 5 minutes. What is the most likely cause of the timeouts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scale-out cooldown period is too long, delaying the addition of new instances.. During peak hours, CPU utilization may spike quickly, but the scaling policy requires CPU to exceed 70% for 5 minutes before triggering a scale-out. If the scale-out cooldown period is too long, additional instances are delayed, causing the existing instances to become overloaded and leading to timeouts. Option A is incorrect because the maximum of 10 instances is likely sufficient; the problem is the speed of scaling. Option B is incorrect because health check failures would cause instance replacement, not timeouts from overload. Option C is incorrect because a 70% threshold is not too low; a lower threshold would cause premature scaling, not timeouts.

Answer

The maximum number of instances is too low.

Answer

The health checks are marking healthy instances as unhealthy.

Answer

The CPU threshold is too low, causing premature scaling.

Question 2

An organization has a site-to-site VPN connection between its on-premises network and a cloud VPC. Users report intermittent connectivity to applications hosted in the cloud. The administrator checks the VPN tunnel status and sees it is up. However, ping tests from on-premises to a cloud instance fail at random times. Which factor should the administrator investigate first?

Accepted Answer

The VPN tunnel is experiencing packet loss due to a mismatch in the IPSec parameters.. Intermittent connectivity with the VPN tunnel appearing up is a classic sign of packet loss or misconfiguration in IPSec parameters (e.g., mismatched phase 1/phase 2 settings, encryption algorithms, or Diffie-Hellman groups). This causes some packets to fail while others pass, leading to intermittent issues. Option A is incorrect because while the on-premises firewall blocking outbound ICMP could cause ping failures, it would not cause intermittent connectivity for all applications; also, the issue is likely VPN-related. Option B is incorrect because a security group blocking ICMP would cause consistent ping failure, not intermittent. Option C is incorrect because missing routes would cause complete failure for all traffic, not intermittent.

Answer

The on-premises firewall is blocking outbound ICMP.

Answer

The security group on the cloud instance is blocking ICMP.

Answer

The routing tables on the cloud VPC are missing routes for the on-premises network.

Question 3

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

Accepted Answer

Migrate to a volume type with provisioned IOPS (SSD).. Standard HDD volumes have low maximum IOPS and burst performance that is quickly exhausted under sustained writes, leading to write latency spikes. Migrating to a volume type with provisioned IOPS, such as SSD, provides consistent and higher write performance without requiring application changes. Option B is incorrect because increasing the volume size does increase baseline IOPS for HDD volumes, but the improvement is marginal and still relies on burst credits, which will be depleted again. Option C is incorrect because moving logs to object storage changes the storage paradigm and would require application modifications to use different APIs. Option D is incorrect because write caching on a data volume is not recommended as it can lead to data loss in the event of a power failure, and caching is typically for read performance.

Answer

Increase the volume size to gain higher baseline IOPS.

Answer

Move the logs to an object storage service.

Answer

Enable write caching on the volume.

Question 4

A company uses a cloud provider's IAM service to manage access. An administrator creates a new IAM role for an application running on an EC2 instance to access an S3 bucket. The application is unable to read objects from the bucket, even though the role has an attached policy that allows s3:GetObject on the bucket. The administrator verifies that the instance is correctly associated with the role. What is the most likely cause?

Accepted Answer

The role's permissions policy has a condition key that restricts access to a specific IP range.. The role's permissions policy is an IAM policy attached to the role that defines what actions the role can perform. If this policy includes a condition key such as `ipAddress` or `SourceIp`, it can restrict access to requests coming from specific IP addresses. If the EC2 instance's public IP address is not within the allowed range, the `s3:GetObject` call will be denied, even though the permission is granted. Option A is incorrect because the stem does not mention any bucket policy, and the question asks for the most likely cause; a bucket policy denying access would be less common than a condition on the role's policy. Option B is incorrect because if the trust policy did not allow EC2 to assume the role, the instance would not receive temporary credentials at all, and the administrator would likely see errors during association. Option D is incorrect because security groups by default allow all outbound traffic, and S3 access uses HTTPS over the internet or VPC endpoints, so outbound blocking is unlikely unless explicitly configured.

Answer

The S3 bucket policy denies access to the role.

Answer

The role's trust policy does not allow the EC2 service to assume the role.

Answer

The instance's security group is blocking outbound traffic to S3.

Question 5

A web application is deployed across multiple availability zones behind a load balancer. The administrator notices that all traffic is being routed to instances in only one availability zone, causing performance issues. The load balancer is configured to distribute traffic across all zones evenly. What is the most likely cause?

Accepted Answer

The instances in the other zones are marked as unhealthy due to failing health checks.. When the load balancer is configured to distribute traffic across all zones, it should balance traffic across all availability zones. However, if instances in other zones fail health checks, they are marked as unhealthy and removed from the rotation, causing all traffic to go to healthy instances in only one zone. Option A is incorrect because firewall rules are not zone-specific; they apply to resources regardless of zone. Option C is incorrect because route tables affect outbound traffic from instances, not load balancer traffic distribution. Option D is incorrect because a single backend pool can contain instances from multiple zones; this does not limit traffic to one zone.

Answer

The firewall rules for the load balancer only allow traffic from one zone.

Answer

The route table for the subnets in the other zones is missing a default route.

Answer

The listener rules are configured to forward traffic to a single backend pool.

Question 6

A cloud administrator is troubleshooting a virtual machine that is experiencing high memory usage. The VM is running a web server. Which two metrics should the administrator monitor to determine if the VM needs additional memory? (Choose two.)

Accepted Answer

Swap usage. Options A and D are correct. Available memory directly shows the amount of free RAM, and swap usage indicates that the OS is using disk as memory, which is a sign of insufficient physical memory. Disk I/O wait (B) is a disk performance metric, page fault rate (C) is a memory metric but is less direct than swap usage for determining if more memory is needed, and CPU ready time (E) is a CPU metric.

Answer

Disk I/O wait

Answer

Page fault rate

Answer

CPU ready time

Question 7

A company's application is unable to connect to a managed cloud database. The database is deployed in a VPC with public accessibility disabled. The application runs on an EC2 instance in the same VPC. Which three troubleshooting steps should the administrator take? (Choose three.)

Accepted Answer

Check the network ACL associated with the database subnet for appropriate rules.. Options B, C, and E are correct. Option A is incorrect because an internet gateway is not needed for communication within the same VPC. Option D is incorrect because a public IP is not required for instances in the same VPC. Option B checks network ACL rules for the database subnet, which can affect inbound/outbound traffic. Option C verifies the database endpoint configuration in the application, which could be misconfigured. Option E checks the security group for the database, ensuring it allows inbound traffic from the EC2 instance's security group.

Answer

Ensure the VPC has an internet gateway attached.

Answer

Verify that the EC2 instance has a public IP address.

Question 8

A cloud administrator is troubleshooting performance issues with a cloud object storage bucket that is used for storing large amounts of small files. The application reads and writes objects frequently. Which three actions could improve the performance? (Choose three.)

Accepted Answer

Increase the number of concurrent requests from the application.. Options B, C, and E are correct. Option B increases throughput by allowing more parallel requests, which helps with small-file performance. Option C uses a CDN to accelerate data transfer, reducing latency. Option E distributes objects across partitions using prefix naming, improving request rate. Option A is incorrect because multi-region buckets add replication latency. Option D is incorrect because versioning adds overhead for frequent writes.

Answer

Use a multi-region bucket to reduce latency.

Answer

Enable versioning to avoid overwrites.

Question 9

The exhibit shows the output of the df command and an application error. What is the most likely cause of the error?

Accepted Answer

The /var partition is full.. The df output shows the /var partition is at 100% utilization, and the application error indicates it cannot write to disk, likely due to the /var partition being full. Option A is incorrect because /dev/shm is a tmpfs and not relevant to application writing to /var/log. Option C is incorrect because there is no evidence of filesystem corruption. Option D is incorrect because the root filesystem still has space; the error indicates a space issue, not inode exhaustion.

Answer

The /dev/shm partition is full.

Answer

The filesystem is corrupt.

Answer

The inode usage on the root filesystem is exhausted.

Question 10

The exhibit shows the health check status for targets in an application load balancer's target group. The target group has a health check on port 80. An administrator notices that one target is unhealthy on port 80 but healthy on port 443. What is the most likely cause?

Accepted Answer

The security group for the target is blocking port 80 from the load balancer.. The target is healthy on port 443 but unhealthy on port 80, indicating that port 80 is not reachable from the load balancer. The most likely cause is that the security group for the target is blocking inbound traffic on port 80 from the load balancer. Option A is incorrect because the target is healthy on 443, so the web server is listening on that port, but it could still be listening on 80; the issue is connectivity. Option C is incorrect because if the load balancer were in a different VPC, it wouldn't be able to communicate with any targets at all. Option D is incorrect because the health check path applies to both port 80 and 443 health checks if configured separately, but since only port 80 is failing and the path is the same, the path is not the issue.

Answer

The web server on the target is not listening on port 443.

Answer

The load balancer is in a different VPC.

Answer

The health check path is incorrect.

Question 11

The exhibit shows VPC flow log entries for an EC2 instance (eni-12345678). The administrator is troubleshooting a connectivity problem where an application on 10.0.1.5 occasionally cannot connect to a web server at 10.0.2.10 on port 80. What action should the administrator take?

Accepted Answer

Add a network ACL rule allowing inbound TCP/80 from 10.0.1.5 to the subnet of 10.0.2.10.. The REJECT entry in the VPC flow log indicates that traffic is being blocked by a network ACL (NACL), which is stateless. Security groups are stateful and do not produce REJECT entries; they either allow or silently drop traffic. To resolve the issue, the administrator must add an inbound rule to the network ACL associated with the subnet of the web server (10.0.2.10) to allow TCP port 80 from the source IP 10.0.1.5. Option C is correct. Option A is incorrect because increasing the MTU does not affect firewall blocking. Option B is incorrect because a security group rule would not generate a REJECT; the REJECT indicates a NACL blockage. Option D is incorrect because adding a route does not address firewall filtering.

Answer

Increase the MTU on the instance to 9001.

Answer

Add a security group rule allowing inbound TCP/80 from 10.0.1.5.

Answer

Add a route to the VPC route table for 10.0.1.5.

Question 12

A cloud administrator notices that a virtual machine is unresponsive. The VM is running on a hypervisor host that shows high CPU utilization. What should the administrator do first?

Accepted Answer

Check the VM console for OS-level issues. The first step in troubleshooting an unresponsive VM is to check the VM console for OS-level issues. This allows the administrator to see if the OS is hung, has a kernel panic, or is waiting for input. Option A is wrong because rebooting the hypervisor host would affect all VMs and is a drastic measure that should only be taken after other diagnostics. Option B is wrong because increasing the VM's vCPU count does not address the root cause of unresponsiveness and could worsen resource contention on an already overloaded host. Option C is wrong because migrating the VM to another host is premature without first determining if the issue is OS-related; also, migration might not be possible if the VM is completely unresponsive.

Answer

Reboot the hypervisor host

Answer

Increase the VM's vCPU count

Answer

Migrate the VM to another host

Question 13

A company is experiencing intermittent network connectivity issues between two cloud subnets. The cloud provider's monitoring shows no packet loss. Which troubleshooting step should be taken first?

Accepted Answer

Review the security group rules for both subnets. Security group rules can cause intermittent connectivity issues by selectively dropping traffic based on stateful inspection, timeouts, or misconfigured rules. Option B is wrong because virtual routers are typically managed by the provider and are unlikely to cause intermittent issues without alerts. Option C is wrong because increasing bandwidth does not address the underlying cause of intermittent drops. Option D is wrong because physical cabling is not relevant in the cloud.

Answer

Replace the virtual routers

Answer

Increase the bandwidth between subnets

Answer

Check the physical cabling

Question 14

An administrator deployed a new web application using an auto-scaling group. Users report that the application becomes slow after a few hours. The administrator examines the scaling policy and notices that the CPU utilization threshold is set to 80% for scale-out and 20% for scale-in. What is the most likely issue?

Accepted Answer

The scale-out threshold is too high, causing delayed scaling. A scale-out threshold of 80% means that new instances are only added when CPU utilization reaches 80%, which can cause delays in scaling out, leading to performance degradation as the application becomes slow over time. Option A is incorrect because a low scale-in threshold of 20% would cause premature termination of instances, not slowness. Option B is incorrect because load balancer misconfiguration would typically cause immediate failures or uneven traffic distribution, not gradual slowdown. Option C is incorrect because a memory leak would cause degradation over time, but the specific symptom of slowness after a few hours combined with the scaling policy thresholds points to the scaling configuration as the primary issue.

Answer

The scale-in threshold is too low, causing instances to be terminated prematurely

Answer

The load balancer is misconfigured

Answer

The application has a memory leak

Question 15

A cloud administrator is troubleshooting a failed backup job that was supposed to back up a database to a cloud storage bucket. The job fails with an access denied error. Which two likely causes should the administrator investigate? (Choose two.)

Accepted Answer

The IAM role assigned to the backup service lacks write permissions to the bucket. Correct options are B and D. Option B is likely because the IAM role assigned to the backup service lacks write permissions to the bucket, resulting in an access denied error. Option D is likely because if the storage bucket has been deleted, the backup job cannot write to it, also producing an access denied error. Option A is incorrect because an offline database would cause a connection error, not access denied. Option C is incorrect because a misconfigured backup schedule would prevent the job from running at the scheduled time, not cause an access denied error. Option E is incorrect because version incompatibility typically results in a software error, not an access denied error.

Answer

The database is offline during backup

Answer

The backup schedule is misconfigured

Answer

The backup software version is incompatible