CV0-004 Troubleshooting Practice Test 7 — 15 Questions

Question 1

A user reports that they cannot connect to a RDS database instance from their application. The security group for the RDS instance allows inbound traffic on port 3306 from the application server's security group. What should the administrator check NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network ACL rules for the RDS subnet. The security group for the RDS instance allows inbound traffic on port 3306 from the application server's security group, which is correct. However, network ACLs (NACLs) are stateless and can block traffic even if security groups allow it. The administrator should check the NACL rules for the RDS subnet to ensure that inbound and outbound rules permit traffic on port 3306 and the ephemeral ports for return traffic. This is the next logical step after verifying security group rules.

Answer

IAM policy attached to the RDS instance

Answer

Route table entries for the RDS subnet

Answer

Outbound security group rules on the RDS instance

Question 2

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

Accepted Answer

Deploy application instances across three availability zones with a load balancer. Deploying application instances across three availability zones behind a load balancer ensures that the failure of any single AZ does not take down the application. The load balancer distributes traffic to healthy instances in the remaining AZs, providing true AZ-level fault tolerance. Three AZs also satisfy the common cloud best practice of N+1 or 2N redundancy.

Answer

Place all instances behind a single load balancer in one zone

Answer

Implement auto-scaling within the same availability zone

Answer

Use larger instance types to handle more load

Question 3

During a disaster recovery test, a cloud administrator discovers that the standby database in a different region is not synchronized with the primary. The primary database uses asynchronous replication. What is the MOST likely reason for the sync failure?

Accepted Answer

Network latency causing replication lag. Asynchronous replication does not wait for the standby to acknowledge each write, so the standby can lag behind the primary. Cross-region replication is especially sensitive to network latency, which directly increases replication lag and can cause the standby to fall out of sync during a DR test. This is the most likely cause given the asynchronous, cross-region setup.

Answer

License expiration on the standby database

Answer

Firewall rules blocking port 3306 between regions

Answer

Incorrect replication configuration using a read replica instead of a standby

Question 4

A cloud administrator notices that a virtual machine is consuming excessive CPU resources with no apparent workload. Which of the following should the administrator investigate FIRST to determine the cause?

Accepted Answer

A runaway process inside the VM. A runaway process inside the VM is the most likely cause when a VM exhibits high CPU utilization without an apparent workload. This could be due to a background service, malware, or an application stuck in an infinite loop. Option A is incorrect because a misconfigured load balancer would direct traffic to the VM, which would result in network and CPU activity associated with processing that traffic, not idle high CPU. Option B is incorrect; CPU hotplug settings affect the ability to add CPUs but do not themselves cause high CPU usage. Option D is incorrect; memory overcommitment affects memory availability, not CPU utilization.

Answer

A misconfigured load balancer sending traffic to the VM

Answer

CPU hotplug settings on the hypervisor

Answer

Memory overcommitment ratio

Question 5

A cloud engineer is troubleshooting a storage performance issue. The storage is backed by a SAN with a mix of SSD and HDD drives. Which of the following metrics would BEST indicate that the storage subsystem is the bottleneck?

Accepted Answer

High disk queue depth and latency. High disk queue depth and latency directly indicate that I/O requests are waiting, which is a classic sign of a storage bottleneck. Low memory usage (A) does not indicate a storage issue. High network utilization (B) could be caused by storage traffic but does not confirm the storage subsystem is the bottleneck; it could be normal. High CPU utilization (D) points to compute, not storage.

Answer

Low memory usage on the hypervisor

Answer

High network utilization on storage network links

Answer

High CPU utilization on all application servers

Question 6

A cloud administrator is investigating why a virtual machine is running slowly. The administrator checks the hypervisor performance metrics. Which TWO of the following metrics indicate CPU contention? (Choose TWO.)

Accepted Answer

High CPU ready time. CPU ready time (option A) and co-stop time (option C) are both indicators of CPU contention. Ready time is time a VM is ready to run but waiting for CPU; co-stop time is time a VM is stopped because another vCPU in the same VM is contending. Option E (High CPU usage percentage) is normal utilization, not contention. Option B (High disk queue depth) is storage-related. Option D (High memory ballooning) is memory-related.

Answer

High disk queue depth

Answer

High memory ballooning

Answer

High CPU usage percentage

Question 7

A cloud administrator is troubleshooting a network connectivity issue between two VPCs connected via a VPC peering connection. The administrator has verified that the route tables are correct and that the security groups allow traffic. However, instances in VPC A cannot ping instances in VPC B. Which TWO of the following could be causing the issue? (Choose TWO.)

Accepted Answer

Network ACLs in VPC B are blocking inbound ICMP. Option A is correct because network ACLs are stateless subnet-level filters that must explicitly allow inbound ICMP (for IPv4, protocol 1, type 8 echo request) and outbound ICMP echo reply (type 0); even though the administrator verified security groups, a restrictive NACL in VPC B would silently drop ping traffic. Option C is correct because a host-based firewall (e.g., iptables, Windows Firewall, or firewalld) running on the target instance operates above the VPC layer and can block ICMP echo requests regardless of correct route tables and security group rules. Option B is not correct because the scenario states security groups already allow traffic, and security groups are stateful, so inbound ICMP would be permitted if configured. Option D is not correct because VPC peering fully supports ICMP traffic between peered VPCs; it is not a protocol limitation. Option E is not correct because the administrator has already verified that the route tables are correct.

Answer

Security groups in VPC A are blocking inbound ICMP

Answer

VPC peering connection does not support ICMP

Answer

Route tables are misconfigured

Question 8

A cloud administrator is troubleshooting why a newly launched VM did not complete its initialization. According to the exhibit, what is the most likely cause?

Accepted Answer

The package repository is not configured correctly. The error 'E: Unable to locate package python3-pip' indicates that the package repository is not configured correctly or the package does not exist in the configured sources. This prevents cloud-init from installing the specified package, so the most likely cause is an incorrect repository configuration. Therefore, option B is correct. Option A is incorrect because cloud-init is executing commands, showing it is installed. Option C is incorrect because the error is about a missing package, not a syntax error. Option D is incorrect because the command ran successfully, indicating no network issues; the problem is repository configuration.

Answer

Cloud-init is not installed on the VM

Answer

The cloud-init user data script contains a syntax error

Answer

The VM does not have internet access

Question 9

A cloud user is unable to connect to a web server VM from the internet after a security group rule was modified. The VM is running and can be pinged from other VMs in the same subnet. What is the most likely cause?

Accepted Answer

The inbound rule for HTTP/HTTPS was removed or misconfigured.. The most likely cause is that the inbound security group rule for HTTP/HTTPS was removed or misconfigured, as security groups act as virtual firewalls controlling traffic to the VM. Since the VM can be pinged from other VMs in the same subnet, the network path and VM's OS are functional, isolating the issue to the security group's inbound rules. Modifying the security group likely removed the rule allowing HTTP/HTTPS traffic from the internet.

Answer

The VM's local firewall is blocking the traffic.

Answer

The VM's routing table is missing a default gateway.

Answer

The VM's DNS settings are incorrect.

Question 10

A cloud administrator cannot deploy a new VM from a custom image. The deployment fails with an error stating 'Incompatible hypervisor version'. What is the most likely cause?

Accepted Answer

The image was created on a newer hypervisor than the current host.. The error 'Incompatible hypervisor version' indicates that the custom image was created on a hypervisor version that is newer than the one on the host where deployment is attempted. Hypervisors like VMware ESXi, Hyper-V, or KVM have version-specific features and virtual hardware compatibility; an image from a newer version may not be supported on an older host.

Answer

The VM's virtual hardware version is too old.

Answer

The image file is corrupt.

Answer

The storage backend does not support the image format.

Question 11

A cloud load balancer is not distributing traffic evenly to backend servers. All servers pass health checks. Which of the following is the most likely cause?

Accepted Answer

Session persistence is enabled and directing traffic to specific servers.. Session persistence (sticky sessions) binds a client to a specific backend server for the duration of a session, typically via a cookie or source IP hash. When enabled, the load balancer deliberately routes repeat requests from the same client to the same backend, which skews the distribution and makes traffic appear uneven even though all servers are healthy. This is the most likely cause because the scenario explicitly states all servers pass health checks, ruling out availability-based causes.

Answer

The health check interval is set too long.

Answer

One of the backend servers has reached its connection limit.

Answer

The health check path is incorrect.

Question 12

A cloud database cluster is experiencing replication lag. The primary node shows high write activity, and the replicas are on different availability zones. Which of the following is the most likely cause?

Accepted Answer

Network latency between the primary and replica zones is high.. Network latency between availability zones is a common cause of replication lag in asynchronous replication setups, especially when the primary has high write activity. Option A is incorrect because synchronous replication would cause the primary to wait for acknowledgment from replicas, leading to write slowdown rather than lag on replicas. Option C is incorrect because insufficient storage on replicas would typically cause disk-full errors, not replication lag. Option D is incorrect because vCPU over-allocation on the primary primarily affects compute performance, not the replication process which is more sensitive to network and disk I/O.

Answer

Replication is configured as synchronous.

Answer

The replica nodes have insufficient storage.

Answer

The primary node's vCPU is over-allocated.

Question 13

A cloud application returns HTTP 503 errors during high traffic. The application runs on VMs behind a load balancer. Which action is most likely to resolve the issue?

Accepted Answer

Add additional VMs to the backend pool.. HTTP 503 Service Unavailable during high traffic indicates that the backend servers cannot handle the current load, often because all VMs are saturated or the load balancer has no healthy backends. Adding additional VMs to the backend pool increases capacity and distributes the load, directly addressing the root cause. This is the standard horizontal scaling response to traffic-induced 503 errors.

Answer

Restart the web server service on one VM.

Answer

Change the DNS TTL to a lower value.

Answer

Increase the health check interval on the load balancer.

Question 14

An automated snapshot of a cloud VM is failing with the error 'Quota exceeded for resource snapshots'. What is the most likely cause?

Accepted Answer

The maximum number of snapshots allowed has been reached.. The error 'Quota exceeded for resource snapshots' directly indicates that the cloud provider's limit on the number of snapshots for that resource (e.g., per volume, per region, or per account) has been reached. Cloud platforms enforce quotas to prevent resource exhaustion, and once the maximum count is hit, further snapshot creation fails until older snapshots are deleted or a quota increase is requested. This is a hard limit, not a transient condition like a backup window or disk fullness.

Answer

The snapshot is being created during a backup window.

Answer

The snapshot retention policy is set too high.

Answer

The VM's disk is too full to create a snapshot.

Question 15

A cloud orchestration template fails to deploy resources with the error 'Resource limit exceeded'. The administrator has enough quota for all services. What is the most likely cause?

Accepted Answer

A specific resource type has reached its service limit.. Certain resource types have service-specific limits that are separate from the overall account quota. Even if the administrator has enough total quota, a specific resource type (e.g., virtual machines, storage accounts) may have reached its maximum allowed count. Option A is incorrect because a syntax error would cause a different error, such as parsing failure. Option C is incorrect because a corrupted image would typically result in image-related errors. Option D is incorrect because permission issues would generate an access denied error, not 'Resource limit exceeded'.

Answer

The template has a syntax error in the JSON.

Answer

The custom image used is corrupted.

Answer

The IAM role used does not have permission to create resources.