CV0-004 Troubleshooting Practice Test 4 — 15 Questions

Question 1

A company recently migrated an application to the cloud. The application uses a load balancer in front of multiple EC2 instances. After the migration, users report that they occasionally receive 'Connection refused' errors. The administrator checks the load balancer health check logs and finds that some instances are marked unhealthy intermittently. The application's health check endpoint returns HTTP 200 when tested manually from the admin's workstation. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security group rules blocking the load balancer health checks. The most likely cause is that the security group rules are blocking the load balancer's health checks. The admin's manual test from a workstation succeeds because the workstation's IP is allowed, but the load balancer's health check traffic originates from the load balancer nodes' IP range, which may not be permitted by the instance security group. This intermittent blocking causes instances to be marked unhealthy, leading to 'Connection refused' errors when the load balancer routes traffic to them.

Answer

The health check interval is too short

Answer

The instances are running out of memory

Answer

The application is not binding to the correct IP address

Question 2

A cloud administrator is troubleshooting a virtual machine that is experiencing high CPU utilization during peak hours. The VM runs a web application and is hosted on a public cloud platform. Which TWO steps should the administrator take first to diagnose the issue?

Accepted Answer

Review the load balancer health check and traffic distribution settings for the backend pool.. Option C is correct because reviewing the load balancer health check and traffic distribution settings for the backend pool helps determine whether uneven or excessive traffic is being routed to this VM, which is a common cause of high CPU during peak hours on a web application. Option D is correct because using OS performance monitoring tools (for example, top, htop, or Task Manager/Performance Monitor) to identify the process consuming the most CPU is the fundamental first diagnostic step to pinpoint the actual workload driving utilization. Option A is not appropriate as a first step because adjusting autoscaling adds capacity without diagnosing the root cause, and it may not even apply if the issue is a single misbehaving process. Option B is premature because checking for memory leaks is a deeper investigation that should follow confirming CPU consumption patterns, and memory leaks do not always manifest as high CPU. Option E is also premature because increasing vCPUs masks the symptom rather than diagnosing it, and it may not resolve the issue if the CPU is consumed by an inefficient or runaway process.

Answer

Adjust the autoscaling policy to add more instances immediately.

Answer

Check for memory leaks in the application that could indirectly affect CPU.

Answer

Immediately increase the number of vCPUs assigned to the VM.

Question 3

A company uses a multi-cloud strategy with workloads on AWS and Azure. An application running on an Amazon EC2 instance in a VPC uses an Azure SQL Database as its backend via a site-to-site VPN. Recently, users reported intermittent timeouts when accessing the application. The EC2 instance passes health checks, and the VPN tunnel status shows as 'UP' from both sides. The application logs show 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' Which of the following is the MOST likely cause of the issue?

Accepted Answer

The Azure SQL Database firewall does not allow traffic from the EC2 instance's IP address or the VPN gateway's IP.. The error message 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' indicates that the Azure SQL Database server rejected the connection attempt. Since the VPN tunnel is 'UP' and the EC2 instance passes health checks, the most likely cause is that the Azure SQL Database firewall rules do not include the source IP address of the traffic coming from the EC2 instance — either the EC2 instance's private IP (if traffic is routed through the VPN) or the public IP of the VPN gateway. Azure SQL Database uses server-level firewall rules to allow client IP addresses, and without an explicit rule, all connections are blocked.

Answer

The EC2 instance has exhausted its CPU credits, causing the application to become unresponsive.

Answer

The VPN tunnel is not properly routing traffic to Azure, causing intermittent connectivity.

Answer

The EC2 instance does not have sufficient IAM permissions to connect to Azure SQL Database.

Question 4

A cloud administrator is troubleshooting a serverless application that intermittently returns HTTP 429 errors to users during peak traffic. The function is configured with a reserved concurrency of 100, but the provider account has a total concurrency limit of 1000. Other functions in the same account are also running. Which action should the administrator take first to resolve the throttling?

Accepted Answer

Request a quota increase for the account's total concurrency limit.. The function is throttled because the account's total concurrency limit is likely exhausted by other functions. Raising the account-level concurrency quota increases the overall capacity, allowing the function to handle more concurrent requests. Adjusting reserved concurrency without addressing the account limit may simply shift the problem. Reducing timeout or enabling provisioned concurrency does not expand the total concurrency pool.

Answer

Increase the reserved concurrency for the function to 500.

Answer

Reduce the function's timeout to free up concurrency faster.

Answer

Enable provisioned concurrency for the function to eliminate cold starts.

Question 5

A cloud engineer is troubleshooting a Linux virtual machine that became unreachable after a security group change. The engineer verifies that the instance is running, has a public IP, and the route table has a default route to the internet gateway. The engineer also confirms that the network ACL allows all inbound and outbound traffic. Which of the following is the MOST likely cause of the connectivity issue?

Accepted Answer

The security group does not allow inbound SSH (port 22) from the engineer's IP address.. The engineer has eliminated network ACLs and route tables as causes. The security group is the next logical component to check because it controls inbound traffic at the instance level. A missing inbound rule for SSH would prevent connectivity even if the instance is healthy. Restoring that rule resolves the issue.

Answer

The route table does not have a route to the internet gateway.

Answer

The network ACL is blocking outbound traffic on ephemeral ports.

Answer

The instance's public IP address has changed due to a reboot.

Question 6

A cloud administrator manages a three-tier application on a public cloud. The web tier runs on virtual machines behind a load balancer, the application tier runs on containers, and the database tier uses a managed relational database service. Users report that the application is slow, but the cloud provider's monitoring shows no resource bottlenecks on the web or database tiers. The administrator suspects a network issue between the web tier and the application tier. Which tool should the administrator use first to capture and analyze the traffic between the two tiers?

Accepted Answer

Cloud provider's flow logs. Flow logs capture IP traffic metadata, including allowed and denied connections, and are the least invasive way to check for network-level blocks or delays between tiers. They are provided by the cloud platform and require no agents on instances, making them ideal for an initial investigation when resource metrics are normal.

Answer

tcpdump on the web tier VMs

Answer

Application logs on the application tier

Answer

Cloud provider's network performance monitor

Question 7

A cloud administrator is troubleshooting a virtual machine (VM) that cannot reach the internet. The VM is in a private subnet with a route table that has a default route pointing to a NAT gateway. The NAT gateway is in a public subnet and has an Elastic IP. The VM's security group allows outbound traffic to 0.0.0.0/0. What is the most likely cause of the connectivity issue?

Accepted Answer

The network ACL associated with the private subnet is blocking outbound traffic.. Network ACLs in the private subnet must allow outbound traffic to the NAT gateway. Since security groups are stateful and already allow outbound, the stateless NACL is the likely culprit. A missing route would also cause failure, but the scenario confirms the route exists. NAT gateways do not have security groups, and private VMs do not need public IPs for outbound access via NAT.

Answer

The VM's public IP address is not attached.

Answer

The private subnet's route table does not have a route to the NAT gateway.

Answer

The NAT gateway's security group is blocking inbound traffic.

Question 8

A cloud administrator is troubleshooting a containerized application deployed on a managed Kubernetes cluster. The application pods are repeatedly crashing and restarting. The administrator runs 'kubectl describe pod' and sees that the pod status is 'CrashLoopBackOff'. The application logs show no output. Which of the following should the administrator check FIRST to determine the root cause?

Accepted Answer

The pod's mounted volumes, config maps, and secrets.. In Kubernetes, a pod that crashes without logs often fails during initialization due to missing dependencies like config maps or secrets. Checking mounted volumes and configuration objects first can quickly identify the root cause. This approach is more efficient than investigating resource limits or network policies, which typically manifest differently.

Answer

The container image's entrypoint and command configuration.

Answer

The cluster's network policies that might block traffic to the pod.

Answer

The pod's resource requests and limits for CPU and memory.

Question 9

A cloud administrator is troubleshooting a containerized application deployed on a managed Kubernetes service. Some pods in a deployment are repeatedly restarting, and the application logs show no errors. The administrator checks the pod status and sees that the containers are being terminated with an exit code 137. Which two actions should the administrator take to resolve this issue? (Choose two.)

Accepted Answer

Increase the memory limit for the container.. Exit code 137 indicates the container was killed by SIGKILL, commonly due to exceeding its memory limit. Increasing the container's memory limit and ensuring the node has sufficient allocatable memory are the immediate corrective actions. Other options address different failure modes or are longer-term investigations.

Answer

Review the application code for memory leaks.

Answer

Adjust the liveness probe to be more lenient.

Answer

Increase the CPU limit for the container.

Question 10

A cloud administrator is troubleshooting a containerized workload on a managed Kubernetes service. Pods are scheduled successfully, but several report CrashLoopBackOff. The application logs inside the container show it exiting immediately with a non-zero status, and the same image runs correctly on a developer workstation. The deployment manifest sets a memory limit of 128 MiB and a memory request of 64 MiB. Which cause is MOST likely?

Accepted Answer

The container exceeds its memory limit at startup and is terminated by the kubelet, producing repeated restarts.. The decisive clues are that the process exits immediately with a non-zero status, that it works outside the cluster, and that a tight memory limit is configured. An out-of-memory kill by the kubelet restarts the container repeatedly, which the scheduler reports as CrashLoopBackOff. Confirming the previous termination reason and comparing actual usage against the limit identifies the constraint before adjusting requests and limits.

Answer

The node's container runtime is outdated, so it cannot execute the image's entrypoint correctly.

Answer

The pod lacks a readiness probe, so the service removes it from endpoints and the orchestrator restarts it.

Answer

The image pull secret is missing, so the kubelet cannot retrieve the image and the container never starts.

Question 11

A cloud administrator notices that a production object storage bucket serving static assets returns HTTP 403 errors for some users while others load the same assets successfully. The bucket policy grants read access to a specific content delivery network (CDN) origin access identity, and an application also writes objects using pre-signed URLs. Which of the following is the MOST likely explanation for the intermittent 403 errors?

Accepted Answer

Some objects were uploaded without the bucket-owner-full-control ACL, so the bucket owner cannot read them despite the bucket policy.. In cross-account uploads, object ownership matters independently of bucket policy. Objects written without the bucket-owner-full-control ACL remain owned by the writing account, so the bucket owner and any identity it delegates to receive 403 even when the bucket policy allows access. The failing assets are those uploaded without that ACL, which explains why only part of the content fails.

Answer

The pre-signed URLs used by the application have expired, and users are requesting objects through those expired URLs.

Answer

The bucket has versioning enabled, and users are requesting object versions that were deleted by a lifecycle rule.

Answer

The CDN is caching 403 responses, so users routed to an edge location that cached an earlier failure receive the cached error.

Question 12

A cloud administrator is troubleshooting a virtual machine that cannot communicate with an external API endpoint. The administrator verifies that the VM has a public IP, the security group allows outbound traffic on port 443, and the route table has a default route to the internet gateway. However, the VM still cannot reach the API. Which of the following should the administrator check NEXT?

Accepted Answer

The network ACL associated with the subnet.. After verifying security groups and route tables, the network ACL is the next cloud-level network control to inspect. Network ACLs are stateless, so they require explicit rules for both outbound traffic and the return traffic on ephemeral ports. A common misconfiguration is to allow outbound 443 but not the corresponding inbound ephemeral ports, which breaks the connection. Checking the network ACL rules can quickly resolve the issue.

Answer

The API endpoint's DNS resolution from the VM.

Answer

The internet gateway's configuration and attachments.

Answer

The VM's operating system firewall rules.

Question 13

A cloud administrator is troubleshooting a virtual machine that cannot reach any external website, although it can reach other virtual machines in the same subnet. The VM's network interface has a public IP attached and the route table for the subnet contains a default route to the internet gateway. What should the administrator check NEXT?

Accepted Answer

The security group and network ACL rules that filter outbound traffic from the VM's subnet.. When addressing and routing are confirmed and only off-subnet traffic fails, the filtering layer becomes the prime suspect. Security groups are stateful and evaluated per interface, while network ACLs are stateless and evaluated per subnet in both directions, so an outbound or egress rule can silently drop internet-bound packets. Reviewing both rule sets is the correct next diagnostic action.

Answer

Whether the public IP address is elastic or dynamically assigned to the network interface.

Answer

Whether the domain name system resolver on the VM is configured to use the provider's DNS service.

Answer

Whether the VM's operating system has the correct default gateway configured in its routing table.

Question 14

A cloud administrator is troubleshooting a virtual machine that cannot reach the internet. The VM has a private IP address, and outbound internet access is provided through a NAT gateway in the same virtual network. Internal connectivity to other VMs works. Which two actions should the administrator take to identify the cause? (Choose two.)

Accepted Answer

Verify that the subnet's route table contains a default route pointing to the NAT gateway.. Outbound internet through a NAT gateway depends on two things: the private subnet routing default traffic to the NAT gateway, and the NAT gateway residing in a public subnet with a route to an internet gateway plus a public address. Verifying the subnet route table and the NAT gateway's placement and addressing isolates the broken half of the path quickly.

Answer

Verify that the VM's DNS server is reachable from the private subnet.

Answer

Check whether the VM's network interface has a public IP address attached.

Answer

Confirm that the NAT gateway's security group allows outbound traffic from the VM's subnet.

Question 15

A cloud administrator is troubleshooting a serverless function that processes messages from a queue. The function occasionally fails with a timeout error after 15 seconds, but the function's code is optimized and typically completes in 2 seconds. The administrator notices that the failures occur only when the queue has a large backlog of messages. Which action should the administrator take to resolve the timeout errors?

Accepted Answer

Increase the function's reserved concurrency.. Timeout errors during a large queue backlog typically indicate that the function's concurrency limit is being reached, causing invocations to be throttled or delayed. Increasing reserved concurrency allows the function to scale out more, processing the backlog faster and preventing timeouts.

Answer

Increase the function's timeout setting to 30 seconds.

Answer

Reduce the function's memory allocation.

Answer

Enable provisioned concurrency for the function.