CV0-004 Troubleshooting Practice Test 6 — 15 Questions

Question 1

A cloud administrator is troubleshooting a web application hosted on a cloud virtual machine (VM) that is experiencing intermittent high latency during peak traffic hours. The application is deployed on a single VM instance with 4 vCPUs and 8 GB RAM, running a Linux OS. The VM is connected to a virtual network with a public IP. The administrator has verified that the application code is optimized and there are no memory leaks. CPU utilization remains below 50% during peaks, but network outbound traffic shows periodic spikes up to 500 Mbps. The VM's network interface is configured with a 1 Gbps bandwidth cap. The administrator suspects that the issue is related to network throttling or packet loss. Which of the following actions should the administrator take to resolve the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upgrade the VM to a larger instance size with higher network bandwidth cap (e.g., 2 Gbps).. The VM's network bandwidth cap of 1 Gbps is being saturated during peak traffic (spikes up to 500 Mbps, but with overhead and burst behavior, the cap can cause throttling and packet loss). Upgrading to a larger instance size with a higher network bandwidth cap (e.g., 2 Gbps) directly addresses the bottleneck by providing more headroom for outbound traffic, reducing latency caused by queueing and drops. The administrator has already ruled out CPU and memory issues, so the network cap is the likely culprit.

Answer

Increase the VM's vCPU count to 8 to improve processing capacity.

Answer

Configure the firewall to allow all traffic to reduce processing overhead.

Answer

Enable DDoS protection on the public IP to filter malicious traffic.

Question 2

A cloud administrator is troubleshooting a performance issue where a web application is responding slowly. The application runs on virtual machines in a private cloud. The administrator has verified that CPU and memory utilization are within normal limits. Which TWO additional metrics should the administrator check to diagnose the issue?

Accepted Answer

Network latency between the application and database servers. Network latency between the application and database servers is a critical metric because slow database queries or network congestion can cause the web application to respond slowly even when CPU and memory on the VMs are normal. High latency increases round-trip time for SQL queries, directly impacting page load times. Disk I/O wait time on the hypervisor is also essential because excessive I/O wait indicates storage contention, which can throttle read/write operations for the VMs, leading to application sluggishness.

Answer

Number of running processes

Answer

Virtual machine snapshot size

Answer

Hypervisor version

Question 3

Sequence the steps to set up a cloud storage bucket with versioning and lifecycle policies.

Accepted Answer

Create bucket, then enable versioning, then add lifecycle rules (transitions and deletions), then test. Create bucket, enable versioning, add lifecycle rules for transitions and deletions, then test.

Answer

Enable versioning, then create bucket, then add lifecycle rules, then test

Answer

Create bucket, then add lifecycle rules, then enable versioning, then test

Answer

Create bucket, then enable versioning, then test, then add lifecycle rules

Question 4

Match each disaster recovery term to its definition.

Accepted Answer

RTO: Maximum allowed downtime. Key disaster recovery terms: RTO focuses on downtime, RPO on data loss, failover is automatic, and cold site has minimal setup. Common confusions involve swapping RTO and RPO definitions or mischaracterizing failover as manual.

Answer

RTO: Maximum acceptable data loss

Answer

Failover: Manual process to restore service

Question 5

A cloud administrator runs a deployment script that creates multiple resources using Infrastructure as Code (IaC). The script fails with a "400 Bad Request" error when attempting to create a storage account. Which troubleshooting step should the administrator take first?

Accepted Answer

Review the error message details for a specific validation error.. A '400 Bad Request' from a cloud API indicates a client-side validation error, such as an invalid parameter, missing required property, or malformed request body. The fastest and most accurate first step is to read the error message details, which typically name the exact field or constraint that failed. This avoids guessing at network, timeout, or region issues that would produce different error codes.

Answer

Check the network connectivity to the cloud API endpoint.

Answer

Increase the timeout value for the API call.

Answer

Verify that the script has the correct region parameter.

Question 6

A company has a three-tier application in a cloud VPC: web servers in a public subnet, application servers in a private subnet, and database servers in a private subnet. The web servers can connect to the application servers, but the application servers cannot connect to the database servers. The security groups are configured as follows:
- Web SG: inbound HTTP from 0.0.0.0/0, outbound all
- App SG: inbound HTTP from Web SG, outbound all
- DB SG: inbound MySQL from App SG, outbound all
What is the most likely cause of the connectivity issue?

Accepted Answer

The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.. The most likely cause is a network ACL (NACL) on the database subnet blocking inbound traffic from the application subnet. Security groups are stateful and allow return traffic, but NACLs are stateless and must explicitly allow both inbound and outbound traffic on ephemeral ports. If the NACL denies inbound MySQL (port 3306) from the app subnet's CIDR, the connection fails even though the security groups are correctly configured.

Answer

The database security group is missing an inbound rule for MySQL.

Answer

The application security group is missing an outbound rule for MySQL.

Answer

The web security group is blocking traffic to the database.

Question 7

A web application is deployed across multiple availability zones behind a load balancer. The administrator notices that all traffic is being routed to instances in only one availability zone, causing performance issues. The load balancer is configured to distribute traffic across all zones evenly. What is the most likely cause?

Accepted Answer

The instances in the other zones are marked as unhealthy due to failing health checks.. If the load balancer is configured to distribute traffic evenly across all availability zones but traffic only reaches one zone, the most likely cause is that instances in the other zones are failing health checks and are marked unhealthy. Load balancers only route to healthy backends, so unhealthy instances in other zones are excluded, concentrating traffic in the one healthy zone. This matches the symptom of uneven distribution despite even configuration.

Answer

The firewall rules for the load balancer only allow traffic from one zone.

Answer

The route table for the subnets in the other zones is missing a default route.

Answer

The listener rules are configured to forward traffic to a single backend pool.

Question 8

A company's application is unable to connect to a managed cloud database. The database is deployed in a VPC with public accessibility disabled. The application runs on an EC2 instance in the same VPC. Which three troubleshooting steps should the administrator take? (Choose three.)

Accepted Answer

Check the network ACL associated with the database subnet for appropriate rules.. Option B is correct because network ACLs are stateless subnet-level firewalls; if the database subnet's NACL lacks an inbound rule allowing the database port (e.g., 3306 for MySQL or 5432 for PostgreSQL) from the EC2 instance's subnet CIDR, and a corresponding outbound rule for the return traffic, connectivity will fail even if security groups are correct. Option C is correct because a misconfigured endpoint (wrong hostname, port, or database name) in the application's connection string is a common cause of connection failures and must be verified before deeper network troubleshooting. Option E is correct because the database's security group must have an inbound rule referencing the EC2 instance's security group (or its CIDR) on the database listener port; since the database is not publicly accessible, this security group reference is the primary stateful access control. Option A is not needed because an internet gateway only enables internet connectivity for public subnets and is irrelevant for instance-to-database traffic within the same VPC. Option D is not needed because a public IP is only required for internet-facing communication, not for private communication between an EC2 instance and a database in the same VPC.

Answer

Ensure the VPC has an internet gateway attached.

Answer

Verify that the EC2 instance has a public IP address.

Question 9

A cloud administrator notices that a virtual machine is unresponsive. The VM is running on a hypervisor host that shows high CPU utilization. What should the administrator do first?

Accepted Answer

Check the VM console for OS-level issues. The first step in troubleshooting an unresponsive VM is to check the VM console for OS-level issues. This allows the administrator to see if the OS is hung, has a kernel panic, or is waiting for input. Option A is wrong because rebooting the hypervisor host would affect all VMs and is a drastic measure that should only be taken after other diagnostics. Option B is wrong because increasing the VM's vCPU count does not address the root cause of unresponsiveness and could worsen resource contention on an already overloaded host. Option C is wrong because migrating the VM to another host is premature without first determining if the issue is OS-related; also, migration might not be possible if the VM is completely unresponsive.

Answer

Reboot the hypervisor host

Answer

Increase the VM's vCPU count

Answer

Migrate the VM to another host

Question 10

A cloud administrator is troubleshooting a failed deployment of a new application version using a continuous integration/continuous deployment (CI/CD) pipeline. The pipeline fails at the 'test' stage. What is the first step the administrator should take?

Accepted Answer

Check the test logs for specific errors. When a CI/CD pipeline fails at the test stage, the first diagnostic step is to examine the test logs to identify the specific error — whether it is a failed assertion, a missing dependency, a timeout, or an environment issue. Logs provide the evidence needed to determine root cause before taking any corrective action. Jumping to re-runs or rollbacks without understanding the failure wastes time and may mask a recurring defect.

Answer

Re-run the pipeline

Answer

Increase the timeout of the test stage

Answer

Roll back to the previous version

Question 11

A company uses a cloud-based load balancer to distribute traffic to web servers. Recently, a new security policy was applied that restricts traffic to certain geographic regions. Users from an allowed region report they cannot access the website. The load balancer status shows health checks are passing. What should the administrator check?

Accepted Answer

The load balancer's access control lists (ACLs). Geographic restrictions on a load balancer are typically implemented via access control lists (ACLs). Since health checks are passing, the web servers are functional, so the issue lies in the load balancer's ACLs blocking traffic from the allowed region. Option A is wrong: DNS resolution would affect all users similarly, not just those from a specific region. Option B is wrong: SSL certificate issues would generate browser warnings or errors, not complete inaccessibility. Option C is wrong: web server logs are irrelevant as the traffic is not reaching the servers due to the ACL block.

Answer

The DNS resolution for the website

Answer

The SSL certificate expiration

Answer

The web server logs for application errors

Question 12

A virtual machine in a cloud environment is experiencing high disk I/O latency. The administrator checks the performance metrics and sees that the disk queue length is consistently above 100. What is the best immediate action?

Accepted Answer

Attach an additional disk and stripe the data. Attach an additional disk and stripe the data. A high disk queue length indicates that the disk is overwhelmed with I/O requests. Stripping data across multiple disks (e.g., RAID 0) distributes the I/O load, reducing queue length and latency. Option B is wrong because network bandwidth does not affect disk I/O. Option C is wrong because migrating to a host with faster disks may help but is not the immediate action; adding disks is quicker and more direct. Option D is wrong because increasing memory does not directly improve disk I/O performance.

Answer

Upgrade the VM's network bandwidth

Answer

Migrate the VM to a host with faster disks

Answer

Increase the VM's memory

Question 13

During a cloud migration, a database server is moved from on-premises to a cloud-managed database service. After migration, the application team reports that some queries are running slower than before. The database CPU utilization is low. What is the most likely cause?

Accepted Answer

The network latency between the application and the database has increased. When a database is moved to a cloud-managed service and queries slow down while CPU utilization is low, the most likely cause is increased network latency between the application and the database. Low CPU indicates the database is not compute-bound, so the delay is likely in the round-trip time for queries. This is common when the application and database are in different regions or availability zones.

Answer

The database is not indexed properly

Answer

The database connection pooling is misconfigured

Answer

The cloud database instance type has insufficient memory

Question 14

A cloud engineer is troubleshooting an issue where an application running in a container on a Kubernetes cluster is unable to resolve DNS names. The cluster uses CoreDNS. The engineer checks the CoreDNS pod logs and sees no errors. Which of the following should the engineer check next?

Accepted Answer

The container's /etc/resolv.conf file. The container's /etc/resolv.conf file contains the DNS configuration, including the nameserver IP and search domains. If CoreDNS logs show no errors, the issue may be that the container is not using the correct DNS server or has a misconfigured resolv.conf. Checking this file is the next logical step.

Answer

The Kubernetes DNS service IP address

Answer

The cloud provider's DNS resolver settings

Answer

The network policy for the namespace

Question 15

A cloud engineer is troubleshooting performance issues in a virtualized environment. Which of the following tools would BEST help identify CPU contention on a hypervisor?

Accepted Answer

esxtop. esxtop is VMware's real-time performance monitoring tool for ESXi hosts, and it exposes CPU metrics such as %RDY (ready time), which directly indicates CPU contention when VMs are waiting for physical CPU cycles. It is the standard tool for diagnosing hypervisor-level CPU scheduling issues.

Answer

iperf

Answer

ping

Answer

nslookup