CV0-004 Troubleshooting Practice Test 5 — 15 Questions

Question 1

A cloud administrator is troubleshooting a serverless function that intermittently fails with timeout errors. The function processes messages from a queue and writes to a database. The function's timeout is set to 30 seconds, and the average execution time is 10 seconds. Cloud monitoring shows that during failures, the function's duration spikes to over 30 seconds, and the database connection pool is frequently exhausted. The function uses a database driver that does not support connection pooling natively. Which two actions should the administrator take to resolve the timeouts? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement retry logic with exponential backoff for database connection attempts within the function.. The function suffers from connection pool exhaustion due to lack of native pooling. Implementing an external connection pool (like Amazon RDS Proxy) allows connection reuse, reducing the number of new connections and preventing exhaustion. Adding retry logic with exponential backoff helps manage transient failures and reduces simultaneous connection attempts, further easing pool pressure. Together, these actions address the root cause of the timeouts.

Answer

Configure the function to use a static IP address to ensure stable database connectivity.

Answer

Reduce the function's memory allocation to decrease execution time.

Answer

Increase the function's timeout to 60 seconds to allow more time for database operations.

Question 2

A cloud administrator is troubleshooting an application deployed across two availability zones that intermittently loses connection to a managed message queue during zone failover tests. The queue endpoint resolves correctly and credentials are valid. Which two actions should the administrator take to diagnose the intermittent failures? (Choose two.)

Accepted Answer

Inspect security group egress rules on the application instances to verify they permit traffic to the queue endpoint's port and protocol.. Intermittent queue connectivity that correlates with availability zone failover points to path and filtering differences between zones. VPC endpoint configuration and route table associations determine whether private connectivity exists for each subnet, while per-zone security group egress rules determine whether traffic is permitted. Verifying both isolates the fault without changing credentials or queue consumption settings that the evidence does not implicate.

Answer

Rotate the queue access credentials and update the application configuration with the new keys.

Answer

Increase the message queue's visibility timeout so messages are not redelivered during failover.

Answer

Enable verbose application logging and disable automatic retries to observe the raw connection errors.

Question 3

A cloud administrator receives an alert that a virtual machine (VM) is unresponsive. The VM is hosted on a hypervisor that shows high CPU ready time. Which of the following is the most likely cause?

Accepted Answer

Over-provisioning of vCPUs on the hypervisor. High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the hypervisor to schedule physical CPU time. This is a classic symptom of over-provisioning vCPUs, where the total number of vCPUs assigned to all VMs exceeds the available physical cores, causing contention at the hypervisor scheduler level.

Answer

Insufficient memory allocated to the VM

Answer

Network latency between the VM and storage

Answer

Disk I/O contention from other VMs

Question 4

A cloud engineer notices that an application is running slower than expected. Monitoring shows that the CPU utilization is consistently below 30%, but memory usage is at 95%. Which of the following is the most likely cause of the performance issue?

Accepted Answer

Insufficient memory causing swapping to disk. When memory usage is at 95% and CPU utilization is low, the system is likely thrashing—the operating system is forced to page memory to disk (swap) to free RAM. Disk I/O is orders of magnitude slower than RAM, so even with idle CPU, the application stalls waiting for swap operations. This explains the performance degradation despite low CPU load.

Answer

Insufficient disk space for application logs

Answer

Network bandwidth saturation

Answer

CPU contention due to overprovisioning

Question 5

A company is implementing a cloud governance strategy. They need to ensure that all resources are tagged with cost center and environment, and any untagged resources are automatically remediated. Which of the following best practices should be applied?

Accepted Answer

Use policy-as-code to enforce tagging and automatically apply tags to untagged resources. Policy-as-code (e.g., Azure Policy, AWS Config Rules, or Open Policy Agent) allows you to define tagging requirements declaratively and automatically remediate non-compliant resources. This approach enforces governance in real-time without manual intervention, ensuring all resources are tagged with cost center and environment as specified.

Answer

Implement role-based access control to restrict resource creation

Answer

Set up budget alerts to notify when costs exceed thresholds

Answer

Create a manual audit process to check tags weekly

Question 6

A cloud engineer is troubleshooting a VM that is experiencing high latency. The VM is hosted on a hypervisor with other VMs. Which TWO metrics should the engineer review to identify if resource contention is occurring?

Accepted Answer

Memory ballooning. Memory ballooning (A) is correct because it directly indicates that the hypervisor is reclaiming guest memory under host-level memory pressure, which is a classic sign of memory contention among co-hosted VMs and can cause latency from paging or reduced cache. CPU ready time (B) is correct because it measures the time a vCPU is runnable but waiting for a physical CPU, which is the definitive metric for CPU contention on an oversubscribed hypervisor. Network packet drops (C) reflect network congestion or NIC issues rather than hypervisor resource contention. Swap usage (D) is a guest-OS symptom that can result from memory pressure but does not itself identify contention between VMs. Disk queue length (E) indicates storage latency or an overloaded datastore, not contention for hypervisor CPU or memory resources.

Answer

Network packet drops

Answer

Swap usage

Answer

Disk queue length

Question 7

A company is migrating on-premises workloads to the cloud. They need to ensure high availability for a stateless web application across two availability zones. Which THREE components should be configured to meet this requirement?

Accepted Answer

An auto scaling group spanning both availability zones. Option A is correct because an auto scaling group spanning both availability zones ensures that instances are distributed across AZs and can automatically replace failed instances, maintaining high availability for the stateless web tier. Option B is correct because a load balancer in front of the web tier distributes incoming traffic across healthy instances in multiple AZs, providing fault tolerance and a single point of entry. Option E is correct because multiple subnets, each in a different availability zone, are required to place the load balancer and auto scaling group across distinct AZs, which is the foundation for AZ-level redundancy. Option C is not correct because a read replica database is a data-tier concern and is not required for a stateless web application's high availability. Option D is not correct because a single large compute instance is a single point of failure and cannot provide high availability across two availability zones.

Answer

A read replica database in a different AZ

Answer

A single large compute instance to handle all traffic

Question 8

A company runs a critical e-commerce application on a cloud platform. The architecture includes a load balancer in front of an auto scaling group of compute instances across two availability zones. The instances are in a private subnet and use a NAT gateway for outbound internet access. The application stores session data in a managed Redis cache cluster. During a flash sale, users report that the site is extremely slow and some requests time out. Monitoring shows the load balancer's latency metric is high, and the number of healthy hosts fluctuates. The CPU utilization on the compute instances averages 60% and memory averages 70%. The Redis cluster's CPU utilization is 90%, and its memory usage is 95%. The NAT gateway's metrics show high BytesOutToSource but no errors. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The managed Redis cache cluster is overloaded and becoming a bottleneck for session lookups. The managed Redis cache cluster is the most likely bottleneck because its CPU utilization is at 90% and memory usage at 95%, indicating it is near capacity. Since the application stores session data in Redis, high latency and timeouts during a flash sale are consistent with an overloaded session store that cannot keep up with request volume, causing the load balancer to experience increased latency and healthy host fluctuations as sessions fail to be retrieved or written.

Answer

The NAT gateway is throttling traffic due to bandwidth limits

Answer

The auto scaling group is not scaling quickly enough due to cooldown periods

Answer

The load balancer's idle timeout setting is too low, causing premature connection drops

Question 9

A cloud administrator notices that a virtual machine (VM) is running slowly. The hypervisor shows high CPU ready time for that VM. Which of the following is the most likely cause?

Accepted Answer

Overcommitted physical CPU resources on the host. High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the physical CPU to become available. This is a classic symptom of CPU overcommitment, where the host has more virtual CPUs (vCPUs) assigned to VMs than physical cores, causing contention. Option C correctly identifies this as the most likely cause.

Answer

High disk I/O latency on the datastore

Answer

Insufficient memory allocated to the VM

Answer

Misconfigured virtual switch

Question 10

A cloud engineer is troubleshooting an issue where users cannot connect to a web application hosted on a cloud VM. The VM's security group allows HTTP (port 80) from 0.0.0.0/0, and the VM's OS firewall is disabled. The engineer can ping the VM's public IP from the internet. What is the most likely cause of the issue?

Accepted Answer

Web server service is not running on the VM. Since the OS firewall is disabled and the security group allows HTTP from 0.0.0.0/0, the only remaining layer that could block connectivity is the application itself. If the web server service (e.g., Apache, Nginx, IIS) is not running on the VM, it will not listen on TCP port 80, so HTTP requests will be refused even though network-level access is permitted. The ability to ping the VM confirms IP-level reachability, isolating the issue to the application layer.

Answer

OS firewall is blocking port 80

Answer

Incorrect routing table on the VM

Answer

Security group rule is applied to the wrong subnet

Question 11

A company uses a hybrid cloud model with an AWS Direct Connect connection to its on-premises network. Users report intermittent connectivity to cloud resources. A network engineer finds packet loss on the Direct Connect virtual interface. Which of the following should be checked FIRST to resolve the issue?

Accepted Answer

The BGP session status between the on-premises router and the AWS Direct Connect endpoint. Intermittent packet loss on a Direct Connect virtual interface is most commonly caused by BGP session flapping or misconfiguration, as BGP is the routing protocol that establishes and maintains connectivity between the on-premises router and the AWS Direct Connect endpoint. Checking the BGP session status first allows the engineer to quickly identify if the issue is due to route advertisement problems, hold timer mismatches, or session resets, which are frequent root causes of intermittent packet loss.

Answer

The physical port status of the Direct Connect router

Answer

The MTU setting on the on-premises firewall

Answer

The VPN tunnel status for the Direct Connect link

Question 12

A cloud engineer is troubleshooting a performance issue where a web server cluster experiences high latency during peak hours. The cluster uses an auto-scaling group behind a load balancer. Which THREE steps should the engineer take to identify the root cause?

Accepted Answer

Monitor CPU and memory utilization on the web servers. Option A is correct because monitoring CPU and memory utilization on the web servers reveals whether the instances are resource-saturated during peak hours, which is a common cause of high latency in an auto-scaling cluster. Option B is correct because analyzing web server access logs for slow requests helps pinpoint which endpoints, queries, or upstream dependencies are contributing to the latency, providing concrete evidence of the bottleneck. Option C is correct because checking the load balancer's backend instance health status verifies whether unhealthy or failing instances are being served or whether health checks are flapping, which directly impacts response times. Option D is incorrect because reducing the number of instances in the auto-scaling group would decrease capacity and likely worsen latency rather than help diagnose the root cause. Option E is incorrect because reviewing security group rules for the load balancer addresses connectivity and access control, not performance degradation during peak hours.

Answer

Reduce the number of instances in the auto-scaling group

Answer

Review security group rules for the load balancer

Question 13

A cloud administrator is configuring a Linux VM as a router. The iptables rules are shown. The administrator can SSH into the VM from the network but cannot forward traffic between interfaces. What is the most likely cause?

Accepted Answer

The FORWARD chain's default policy is DROP and no rules allow forwarding. The FORWARD chain in iptables controls traffic that passes through the VM (i.e., traffic not destined for the VM itself). If its default policy is DROP and no explicit ACCEPT rules exist for forwarding, the kernel will drop all forwarded packets, preventing the VM from acting as a router. SSH access works because it uses the INPUT chain, which is separate from FORWARD.

Answer

The INPUT chain has a rule dropping invalid packets

Answer

The INPUT chain is missing a rule to allow forwarded traffic

Answer

The NAT table is misconfigured

Question 14

A cloud engineer receives an alert that the root filesystem (/) is at 93% usage. The /data volume has plenty of free space. The application stores logs in /var/log/app/ on the root filesystem. Which of the following is the BEST long-term solution?

Accepted Answer

Move the /var/log/app directory to the /data partition and create a symlink. Moving the /var/log/app directory to the /data partition and creating a symlink is the best long-term solution because it permanently relocates the log data to a volume with ample free space without requiring application reconfiguration. The symlink (/var/log/app -> /data/app) makes the application continue to write to the same logical path, while the actual storage is on the /data filesystem. This resolves the root filesystem capacity issue without altering the application's logging behavior or risking data loss.

Answer

Increase the size of the root filesystem

Answer

Delete the /data partition and merge it with root

Answer

Configure log rotation to delete logs more frequently

Question 15

A company has a cloud-based application that uses a relational database. The database team performs daily backups to an on-premises storage system using a VPN connection. Recently, backups have been failing with timeout errors. The network team confirms the VPN is up and stable. Which of the following is the MOST likely cause?

Accepted Answer

The VPN bandwidth is insufficient for the backup data volume. The VPN connection is confirmed stable, so tunnel configuration and firewall issues are unlikely. Backup timeout errors with large data volumes typically indicate insufficient bandwidth, causing the transfer to exceed the timeout threshold. The database service itself is responding (backups are attempted), ruling out service unavailability.

Answer

The database service is not responding

Answer

The VPN tunnel is not properly configured

Answer

The on-premises firewall is blocking the backup port