CV0-004 Troubleshooting Practice Test 4 — 15 Questions

Question 1

An organization is migrating workloads to the cloud and after migration, users complain about slow application response times. The administrator reviews the cloud provider's dashboard and sees no resource bottlenecks. Which three factors could still cause poor performance? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS resolution delays due to on-premises DNS server. Correct options are B, C, and E. Option B is correct because DNS resolution delays caused by an on-premises DNS server can increase response times without appearing as a resource bottleneck on the cloud provider's dashboard. Option C is correct because geographic latency between the cloud region and the users' location is a network issue, not a resource bottleneck, so it won't show on the dashboard. Option E is correct because a TCP window scaling mismatch can degrade network throughput transparently, without affecting resource metrics. Option A is incorrect because an application not optimized for the cloud would typically cause high resource usage, which would appear as a bottleneck on the dashboard. Option D is incorrect because insufficient CPU cores would result in high CPU utilization, visible as a resource bottleneck on the dashboard.

Answer

The application is not optimized for the cloud infrastructure

Answer

Insufficient number of CPU cores in the VM

Question 2

A cloud engineer receives alerts that a storage volume is reaching capacity. Which three immediate actions should the engineer consider? (Choose three.)

Accepted Answer

Attach additional volumes. Correct options are A, D, and E. Option A is correct because attaching additional volumes increases total capacity immediately. Option D is correct because deleting unnecessary files frees up space quickly. Option E is correct because increasing the size of the storage volume provides more space without data migration. Option B is incorrect because creating a snapshot is a precautionary backup step, not an immediate remedy for capacity issues. Option C is incorrect because enabling compression may not affect existing data and is not an immediate solution.

Answer

Create a snapshot before making changes

Answer

Enable compression on the volume

Question 3

Refer to the exhibit. An administrator is unable to SSH into a cloud server with IP 10.0.1.10 from a remote location (outside the 10.0.0.0/16 network). What is the most likely cause?

Accepted Answer

The firewall rule order is incorrect. Firewall rules are evaluated in order; the first rule (rule #1) drops all SSH traffic from any source, and the second rule (rule #2) permits SSH traffic only from the internal network (10.0.0.0/16). Since the remote location is outside this network, the packet matches the first rule and is dropped before reaching the second rule. Option B is incorrect because the firewall is not dropping all packets on port 22; it only drops those from external sources due to the rule order. Option C is incorrect because a host key change would cause a different SSH warning, not a connection timeout. Option D is incorrect because if the SSH service were not running, the error would be 'connection refused' rather than a timeout.

Answer

The firewall is dropping all packets on port 22

Answer

The SSH host key has changed

Answer

The SSH service is not running

Question 4

Refer to the exhibit. A cloud engineer is using AzCopy to transfer files to Azure Blob Storage. The copy fails with the above error. Which of the following is the most likely cause?

Accepted Answer

The SAS token used has expired. The error explicitly indicates an authentication failure, which is typically due to an expired or invalid SAS token. Option A is wrong because a firewall block would result in a different error (e.g., 403 Forbidden). Option C is wrong because a non-existent container would return a 404 error. Option D is wrong because insufficient throughput would cause a timeout, not an authentication error.

Answer

The network throughput is insufficient

Answer

The storage account firewall is blocking the IP

Answer

The destination container does not exist

Question 5

Refer to the exhibit. An application running on an EC2 instance is failing to connect to an RDS database. What is the most likely issue?

Accepted Answer

The security group for the RDS instance does not allow inbound traffic from the EC2 instance. A 'connection refused' error typically indicates that the database is reachable but the port is blocked, likely by a security group. Option A is wrong if the database is in a different VPC, the error would be timeout or no route. Option C is wrong because a stopped database would result in a 'no route to host' or timeout. Option D is wrong because port 3306 is standard for MySQL and the error is not about wrong port.

Answer

The database instance is in a different VPC

Answer

The database instance is stopped

Answer

The application is using the wrong database port

Question 6

A cloud administrator is troubleshooting a failed deployment of a new application version using a continuous integration/continuous deployment (CI/CD) pipeline. The pipeline fails at the 'test' stage. What is the first step the administrator should take?

Accepted Answer

Check the test logs for specific errors. Checking the test logs for specific errors is the first step in troubleshooting a failed pipeline. It provides detailed information about what went wrong during the test stage. Option A is incorrect because re-running the pipeline without investigating the failure is unlikely to fix the underlying issue and wastes time. Option B is incorrect because increasing the timeout does not address the root cause of the failure; it only delays the timeout, which may not be the problem. Option C is incorrect because rolling back should be done only after understanding the failure and deciding to revert, not as a first step.

Answer

Re-run the pipeline

Answer

Increase the timeout of the test stage

Answer

Roll back to the previous version

Question 7

A company uses a cloud-based load balancer to distribute traffic to web servers. Recently, a new security policy was applied that restricts traffic to certain geographic regions. Users from an allowed region report they cannot access the website. The load balancer status shows health checks are passing. What should the administrator check?

Accepted Answer

The load balancer's access control lists (ACLs). Geographic restrictions on a load balancer are typically implemented via access control lists (ACLs). Since health checks are passing, the web servers are functional, so the issue lies in the load balancer's ACLs blocking traffic from the allowed region. Option A is wrong: DNS resolution would affect all users similarly, not just those from a specific region. Option B is wrong: SSL certificate issues would generate browser warnings or errors, not complete inaccessibility. Option C is wrong: web server logs are irrelevant as the traffic is not reaching the servers due to the ACL block.

Answer

The DNS resolution for the website

Answer

The SSL certificate expiration

Answer

The web server logs for application errors

Question 8

An organization's hybrid cloud environment uses a VPN connection between on-premises and the cloud. Intermittent connectivity drops are reported during peak hours. The VPN logs show rekeying failures. Which configuration is most likely the cause?

Accepted Answer

The IPSec dead peer detection interval is set too high. A dead peer detection (DPD) interval set too high delays detection of lost peers, causing rekeying failures under load. Option A is wrong because pre-shared keys don't expire. Option C is wrong because throughput exceeded would show packet loss or high latency, not rekeying failures. Option D is wrong because blocking IKE packets would prevent the VPN from establishing at all.

Answer

The VPN tunnel is using a pre-shared key that has expired

Answer

The VPN gateway throughput is exceeded

Answer

The on-premises firewall is blocking IKE packets

Question 9

A virtual machine in a cloud environment is experiencing high disk I/O latency. The administrator checks the performance metrics and sees that the disk queue length is consistently above 100. What is the best immediate action?

Accepted Answer

Attach an additional disk and stripe the data. Attach an additional disk and stripe the data. A high disk queue length indicates that the disk is overwhelmed with I/O requests. Stripping data across multiple disks (e.g., RAID 0) distributes the I/O load, reducing queue length and latency. Option B is wrong because network bandwidth does not affect disk I/O. Option C is wrong because migrating to a host with faster disks may help but is not the immediate action; adding disks is quicker and more direct. Option D is wrong because increasing memory does not directly improve disk I/O performance.

Answer

Upgrade the VM's network bandwidth

Answer

Migrate the VM to a host with faster disks

Answer

Increase the VM's memory

Question 10

During a cloud migration, a database server is moved from on-premises to a cloud-managed database service. After migration, the application team reports that some queries are running slower than before. The database CPU utilization is low. What is the most likely cause?

Accepted Answer

The network latency between the application and the database has increased. Increased network latency between the application and the cloud database can slow query response times without raising CPU utilization. Option B is wrong: improper indexing forces full table scans, which typically increase CPU usage. Option C is wrong: misconfigured connection pooling usually leads to connection errors or timeouts, not consistently slow queries with low CPU. Option D is wrong: insufficient memory causes swapping and high disk I/O, which would increase CPU usage.

Answer

The database is not indexed properly

Answer

The database connection pooling is misconfigured

Answer

The cloud database instance type has insufficient memory

Question 11

A cloud engineer is troubleshooting an issue where an application running in a container on a Kubernetes cluster is unable to resolve DNS names. The cluster uses CoreDNS. The engineer checks the CoreDNS pod logs and sees no errors. Which of the following should the engineer check next?

Accepted Answer

The container's /etc/resolv.conf file. The container's /etc/resolv.conf file. In Kubernetes, pods use the DNS configuration specified in their /etc/resolv.conf, which should point to the CoreDNS service IP. If this file is misconfigured (e.g., due to a custom pod DNS policy or a problem with the kubelet), DNS resolution will fail. The CoreDNS pod logs show no errors, indicating CoreDNS is running fine, so the issue is likely in how the pod is configured to contact CoreDNS. Option A (checking the Kubernetes DNS service IP) is not the next step because the DNS service IP is typically correct; the problem is whether the pod is using it. Option C (checking the cloud provider's DNS resolver settings) is for external DNS resolution, not for internal cluster DNS. Option D (checking network policies) would cause traffic to be dropped entirely, not just DNS, and would likely show in logs or other symptoms.

Answer

The Kubernetes DNS service IP address

Answer

The cloud provider's DNS resolver settings

Answer

The network policy for the namespace

Question 12

A cloud administrator notices that a virtual machine is running but cannot be reached over the network. The administrator verifies that the VM is configured with the correct IP address and subnet mask. Which of the following is the MOST likely cause of this issue?

Accepted Answer

Misconfigured default gateway. A misconfigured default gateway is the most likely cause when the IP address and subnet mask are correct but the VM cannot be reached over the network. The default gateway is responsible for routing traffic from the VM to other networks. If it is incorrect, the VM can communicate within its own subnet but not beyond, leading to unreachability. Option A (firewall blocking traffic) is less likely because the administrator verified correct IP configuration, and a firewall issue would typically affect specific ports or protocols, not all connectivity. Option B (incorrect DNS) affects name resolution but not basic IP connectivity. Option C (missing port forwarding) is used for inbound NAT mappings and is not relevant to general network reachability.

Answer

Cloud provider firewall blocking all traffic

Answer

Incorrect DNS server settings

Answer

Missing port forwarding rule

Question 13

A cloud engineer is troubleshooting performance issues in a virtualized environment. Which of the following tools would BEST help identify CPU contention on a hypervisor?

Accepted Answer

esxtop. 'esxtop' (on VMware) provides real-time performance data including CPU ready time, which directly indicates CPU contention. Option A is incorrect because 'iperf' measures network throughput. Option C is incorrect because 'ping' tests basic connectivity. Option D is incorrect because 'nslookup' is for DNS resolution.

Answer

iperf

Answer

ping

Answer

nslookup

Question 14

A user reports that they cannot connect to a RDS database instance from their application. The security group for the RDS instance allows inbound traffic on port 3306 from the application server's security group. What should the administrator check NEXT?

Accepted Answer

Network ACL rules for the RDS subnet. The RDS security group already allows inbound traffic from the application server's security group, so the issue likely lies elsewhere. Network ACLs (NACLs) are stateless and apply to the subnet level; they must allow both inbound and outbound traffic in both directions for the connection. Checking NACL rules is the next step. Option A is incorrect because IAM policies control access permissions, not network connectivity. Option C is incorrect because route tables primarily govern traffic between subnets and to the internet; within the same VPC, routes are typically not the cause of this issue. Option D is incorrect because outbound rules on the RDS instance affect traffic leaving the RDS, not incoming connections.

Answer

IAM policy attached to the RDS instance

Answer

Route table entries for the RDS subnet

Answer

Outbound security group rules on the RDS instance

Question 15

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

Accepted Answer

Deploy application instances across three availability zones with a load balancer. Deploying across multiple availability zones provides high availability. Option A is wrong because vertical scaling does not address zone failure. Option B is wrong because auto-scaling within a single zone does not help if the zone fails. Option C is wrong because a single load balancer in one zone is a single point of failure.

Answer

Place all instances behind a single load balancer in one zone

Answer

Implement auto-scaling within the same availability zone

Answer

Use larger instance types to handle more load