CV0-004 Troubleshooting — Timed 20 Questions

Question 1

A company is designing a multi-cloud disaster recovery solution. They need to ensure RPO of 15 minutes and RTO of 1 hour for critical workloads. Which of the following should be implemented?

Accepted Answer

Synchronous replication to a standby environment in another cloud provider. Synchronous replication ensures that data is written to both the primary and standby environments simultaneously, guaranteeing zero data loss and meeting the 15-minute RPO. With a pre-configured standby environment in another cloud provider, failover can occur within minutes, satisfying the 1-hour RTO. This approach provides the lowest possible RPO and RTO for critical workloads.

Answer

Asynchronous replication to a secondary cloud with a 30-minute delay

Answer

Pilot light environment that is started manually during a disaster

Answer

Daily backups to object storage in a different region

Question 2

A cloud administrator is troubleshooting connectivity issues between two virtual networks in different regions. The virtual networks are peered, but instances cannot communicate. The administrator verifies that the peering status is 'Connected' and route tables appear correct. Which of the following should be checked next?

Accepted Answer

Network security group rules on the instances and subnets. Even when virtual network peering status shows 'Connected' and route tables are correct, network security group rules can still block traffic. Network security groups act as a stateful firewall at the subnet or network interface level, and typically they deny all inbound traffic unless explicitly allowed. Since the administrator has already verified routing, the next logical step is to check network security group rules for any implicit deny or missing allow rules that could be dropping the inter-region traffic.

Answer

DNS resolution settings

Answer

Gateway subnet configuration

Answer

Service endpoint status

Question 3

Refer to the exhibit. An administrator runs the command shown and receives the output. The administrator wants to ensure the VM uses SSDs for the OS disk. Based on the output, what is the current storage type?

Accepted Answer

Premium SSD (Premium_LRS). The storage account type 'Premium_LRS' indicates Premium SSD. In Azure, the storage account type for managed disks determines the underlying hardware: 'Premium_LRS' maps to Premium SSD, 'StandardSSD_LRS' to Standard SSD, and 'Standard_LRS' to Standard HDD. The command output would show the OS disk's storage account type as 'Premium_LRS', confirming it uses SSDs with premium performance.

Answer

Ultra Disk (UltraSSD_LRS)

Answer

Standard HDD (Standard_LRS)

Answer

Standard SSD (StandardSSD_LRS)

Question 4

Refer to the exhibit. A cloud engineer is troubleshooting network connectivity to a server with IP 10.0.0.5. The server is on the same subnet. Based on the iptables rules shown, what is the most likely cause of the connectivity failure?

Accepted Answer

The INPUT chain drops all traffic destined to the 10.0.0.0/8 network. The INPUT chain has a rule that drops all traffic destined to the 10.0.0.0/8 network, which includes the target server at 10.0.0.5. Since the server is on the same subnet, traffic to it must traverse the INPUT chain on the local system, and this DROP rule will match and discard packets before any other rule can accept them. The rule's position and destination match make it the most direct cause of the connectivity failure.

Answer

The FORWARD chain policy drops all traffic

Answer

The OUTPUT chain rejects all traffic to the server

Answer

The DROP rule in INPUT has zero packet count, so it is not effective

Question 5

A cloud administrator receives an alert that a VM's disk usage is at 95%. The VM is running a critical database. Which TWO actions should the administrator take to resolve the issue while minimizing downtime?

Accepted Answer

Increase the size of the existing disk. Option A is correct because expanding the size of the existing disk (e.g., growing the virtual disk in the hypervisor and then extending the volume/partition with tools like diskpart, growpart, or LVM pvresize/lvextend) adds capacity to the same volume, so the database keeps running with no data migration and minimal downtime. Option C is correct because clearing temporary files and logs (e.g., old transaction logs, tempdb files, or /tmp contents) immediately frees space on the affected volume, providing fast relief for a database at 95% without requiring a reboot or storage reconfiguration. Option B is not appropriate because shrinking a partition on a live critical database risks data loss and is often unsupported or requires unmounting the volume, increasing downtime. Option D is not appropriate because restoring from backup to a larger disk overwrites current data and causes significant downtime, losing any changes since the backup. Option E is not appropriate because adding a new disk and moving data requires migration or reconfiguration of the database paths, which is more disruptive and time-consuming than simply extending the existing disk or clearing temporary files.

Answer

Shrink an existing partition to free space

Answer

Restore the VM from a recent backup to a larger disk

Answer

Add a new disk and move data to it

Question 6

A cloud technician is troubleshooting connectivity from a VM with IP 10.0.0.1 to another VM at 10.0.1.10 in a different subnet. The ping output shows 'Destination Host Unreachable'. Which of the following is the most likely cause?

Accepted Answer

The source's default gateway does not have a route to the destination network. The 'Destination Host Unreachable' error indicates that the source VM (10.0.0.1) cannot find a path to the destination subnet (10.0.1.0/24). Since the VMs are in different subnets, the source must send traffic to its default gateway. If that gateway lacks a route to 10.0.1.0/24, it will drop the packet and send an ICMP Destination Unreachable message back, causing the observed error. This is the most likely cause because the issue is at Layer 3 routing, not Layer 2 ARP or local interface problems.

Answer

ARP resolution for the destination IP is failing

Answer

The network interface on the source VM is disabled

Answer

A firewall is blocking ICMP on the destination

Question 7

A cloud administrator is troubleshooting connectivity to a virtual machine with IP address 10.10.10.10 from another VM on the same subnet. The output of ping and traceroute commands is shown. What is the most likely cause of the connectivity issue?

Accepted Answer

The destination VM's network interface is disabled.. A disabled network interface on the destination VM would cause the VM to be unreachable from the same subnet, even though the VM itself is powered on. Ping and traceroute would fail with no response, as the NIC is not operational at Layer 2, preventing ARP resolution and frame delivery. This matches the symptom of no connectivity despite being on the same subnet, where routing and security groups are not factors.

Answer

The destination VM is powered off.

Answer

The source VM's routing table does not have a default gateway.

Answer

The destination VM's security group is blocking ICMP.

Question 8

A company hosts a critical application on a single virtual machine in a public cloud. The virtual machine has been running without issues for months. Recently, the application became unresponsive, and users report a '500 Internal Server Error'. The cloud administrator checks the virtual machine's status and finds it is 'Running'. The administrator can successfully ping the virtual machine's public IP address. The administrator then attempts to SSH into the virtual machine but receives 'Connection timed out'. The virtual machine's security group allows SSH (port 22) from the administrator's IP address. The operating system firewall is enabled and configured to allow SSH. What should the administrator do next to troubleshoot the issue?

Accepted Answer

Use a serial console or out-of-band management to access the virtual machine's console.. The administrator can ping the VM (ICMP works) but SSH (TCP/22) times out, indicating the application is running but the SSH service or network stack is not responding to new connections. Since the cloud security group and OS firewall are correctly configured, the issue is likely at the OS level (e.g., SSH daemon crashed, kernel panic, or network service hung). Using a serial console or out-of-band management (e.g., AWS EC2 Serial Console, Azure Serial Console) provides direct, network-independent access to the VM's console, bypassing the broken network stack to diagnose and fix the OS-level problem.

Answer

Reset the virtual machine from the cloud provider's management console.

Answer

Create a new virtual machine and migrate the application.

Answer

Check the application logs from the cloud provider's monitoring service.

Question 9

A cloud administrator is troubleshooting a performance issue where users report slow access to a web application hosted in a public cloud. The application uses an auto-scaling group of web servers behind a load balancer. The administrator notices that the CPU utilization on the web servers is low, but the load balancer metrics show a high number of pending requests. What is the most likely cause?

Accepted Answer

The load balancer health checks are misconfigured, causing healthy instances to be removed.. Low CPU utilization on the web servers combined with a high number of pending requests at the load balancer indicates that the load balancer is not forwarding traffic to the backend instances even though they are healthy and idle. This pattern is characteristic of misconfigured health checks that mark healthy instances as unhealthy, removing them from the target pool and causing requests to queue. When all instances are deregistered, the load balancer has nowhere to send traffic, so requests accumulate as pending.

Answer

The web servers are throttled by the cloud provider's API rate limiting.

Answer

The DNS records point to an incorrect IP address.

Answer

The security group is blocking inbound traffic on port 80.

Question 10

A company is running a database server on a virtual machine in the cloud. The database team reports that write operations are taking longer than expected. The administrator checks the disk performance metrics and sees that the average disk queue length is consistently above 10. Which action would most likely resolve this issue?

Accepted Answer

Upgrade to a higher IOPS tier for the disk.. A sustained average disk queue length above 10 indicates the disk subsystem cannot keep up with I/O demand, so requests are queuing. Upgrading to a higher IOPS tier (e.g., from gp2 to io2 or a higher provisioned IOPS tier) increases the disk's ability to service concurrent writes, directly reducing queue depth and write latency.

Answer

Add more RAM to the virtual machine.

Answer

Increase the size of the disk.

Answer

Enable compression on the database.

Question 11

A cloud administrator manages a web application that uses an auto scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The CPU utilization for the ASG averages 40%. However, during peak hours, users experience intermittent timeouts. The administrator reviews the scaling policy, which is set to scale out when CPU exceeds 70% for 5 minutes. What is the most likely cause of the timeouts?

Accepted Answer

The scale-out cooldown period is too long, delaying the addition of new instances.. The scale-out cooldown period prevents the ASG from launching additional instances immediately after a scaling activity, so if the cooldown is too long, the group cannot add capacity fast enough during a sudden traffic spike. Even though the CPU threshold (70% for 5 minutes) is eventually met, the cooldown delays the launch of new instances, causing timeouts while the existing instances are saturated. Reducing the cooldown or using a target tracking/step scaling policy with faster response would mitigate this.

Answer

The maximum number of instances is too low.

Answer

The health checks are marking healthy instances as unhealthy.

Answer

The CPU threshold is too low, causing premature scaling.

Question 12

An organization has a site-to-site VPN connection between its on-premises network and a cloud VPC. Users report intermittent connectivity to applications hosted in the cloud. The administrator checks the VPN tunnel status and sees it is up. However, ping tests from on-premises to a cloud instance fail at random times. Which factor should the administrator investigate first?

Accepted Answer

The VPN tunnel is experiencing packet loss due to a mismatch in the IPSec parameters.. Intermittent connectivity with the VPN tunnel appearing up is a classic sign of packet loss or misconfiguration in IPSec parameters (e.g., mismatched phase 1/phase 2 settings, encryption algorithms, or Diffie-Hellman groups). This causes some packets to fail while others pass, leading to intermittent issues. Option A is incorrect because while the on-premises firewall blocking outbound ICMP could cause ping failures, it would not cause intermittent connectivity for all applications; also, the issue is likely VPN-related. Option B is incorrect because a security group blocking ICMP would cause consistent ping failure, not intermittent. Option C is incorrect because missing routes would cause complete failure for all traffic, not intermittent.

Answer

The on-premises firewall is blocking outbound ICMP.

Answer

The security group on the cloud instance is blocking ICMP.

Answer

The routing tables on the cloud VPC are missing routes for the on-premises network.

Question 13

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

Accepted Answer

Migrate to a volume type with provisioned IOPS (SSD).. Standard HDD volumes have low maximum IOPS and burst performance that is quickly exhausted under sustained writes, leading to write latency spikes. Migrating to a volume type with provisioned IOPS, such as SSD, provides consistent and higher write performance without requiring application changes. Option B is incorrect because increasing the volume size does increase baseline IOPS for HDD volumes, but the improvement is marginal and still relies on burst credits, which will be depleted again. Option C is incorrect because moving logs to object storage changes the storage paradigm and would require application modifications to use different APIs. Option D is incorrect because write caching on a data volume is not recommended as it can lead to data loss in the event of a power failure, and caching is typically for read performance.

Answer

Increase the volume size to gain higher baseline IOPS.

Answer

Move the logs to an object storage service.

Answer

Enable write caching on the volume.

Question 14

A company uses a cloud provider's IAM service to manage access. An administrator creates a new IAM role for an application running on an EC2 instance to access an S3 bucket. The application is unable to read objects from the bucket, even though the role has an attached policy that allows s3:GetObject on the bucket. The administrator verifies that the instance is correctly associated with the role. What is the most likely cause?

Accepted Answer

The role's permissions policy has a condition key that restricts access to a specific IP range.. The role's permissions policy is an IAM policy attached to the role that defines what actions the role can perform. If this policy includes a condition key such as `ipAddress` or `SourceIp`, it can restrict access to requests coming from specific IP addresses. If the EC2 instance's public IP address is not within the allowed range, the `s3:GetObject` call will be denied, even though the permission is granted. Option A is incorrect because the stem does not mention any bucket policy, and the question asks for the most likely cause; a bucket policy denying access would be less common than a condition on the role's policy. Option B is incorrect because if the trust policy did not allow EC2 to assume the role, the instance would not receive temporary credentials at all, and the administrator would likely see errors during association. Option D is incorrect because security groups by default allow all outbound traffic, and S3 access uses HTTPS over the internet or VPC endpoints, so outbound blocking is unlikely unless explicitly configured.

Answer

The S3 bucket policy denies access to the role.

Answer

The role's trust policy does not allow the EC2 service to assume the role.

Answer

The instance's security group is blocking outbound traffic to S3.

Question 15

A cloud administrator is troubleshooting a virtual machine that is experiencing high memory usage. The VM is running a web server. Which two metrics should the administrator monitor to determine if the VM needs additional memory? (Choose two.)

Accepted Answer

Swap usage. Swap usage (A) is correct because when a VM exhausts its physical memory, the hypervisor or guest OS begins paging memory to disk; rising swap consumption directly signals memory pressure and the need for more RAM. Available memory (D) is correct because monitoring the amount of free/unused memory in the guest shows how close the VM is to exhausting its allocated RAM, a primary indicator for a memory upgrade. Disk I/O wait (B) is not a memory-specific metric—it reflects storage latency and could be caused by disk contention, not memory shortage. Page fault rate (C) can indicate memory pressure, but it is not one of the two metrics the exam expects here and is less direct than swap usage and available memory. CPU ready time (E) measures CPU scheduling contention in the hypervisor, not memory consumption, so it does not indicate a need for additional memory.

Answer

Disk I/O wait

Answer

Page fault rate

Answer

CPU ready time

Question 16

A cloud administrator is troubleshooting performance issues with a cloud object storage bucket that is used for storing large amounts of small files. The application reads and writes objects frequently. Which three actions could improve the performance? (Choose three.)

Accepted Answer

Increase the number of concurrent requests from the application.. Option B is correct because object storage services such as Amazon S3 scale throughput with request concurrency, so issuing more parallel GET/PUT requests from the application raises aggregate IOPS and bandwidth for many small objects. Option C is correct because enabling transfer acceleration (e.g., S3 Transfer Acceleration, which uses edge locations and the AWS backbone) or fronting reads with a CDN reduces latency and offloads repeated reads for frequently accessed objects. Option E is correct because distributing object keys across many prefixes spreads requests over multiple internal partitions, avoiding hot-partition throttling and improving request rates for small-file workloads. Option A is not appropriate because a multi-region bucket (e.g., S3 Multi-Region Access Points) targets cross-region resilience and latency for geographically dispersed clients, not raw throughput for frequent small-object reads/writes in one region. Option D is not appropriate because versioning only retains object versions to protect against overwrites or deletions; it adds storage and request overhead and does not improve read/write performance.

Answer

Use a multi-region bucket to reduce latency.

Answer

Enable versioning to avoid overwrites.

Question 17

The exhibit shows the output of the df command and an application error. What is the most likely cause of the error?

Accepted Answer

The /var partition is full.. The df output shows the /var filesystem at 100% utilization, and applications that write logs, spool files, or runtime data to /var will fail with 'No space left on device' errors. The most likely cause is that /var is full, so freeing space or extending the volume resolves the error. This matches the classic symptom of a full partition rather than corruption or inode exhaustion.

Answer

The /dev/shm partition is full.

Answer

The filesystem is corrupt.

Answer

The inode usage on the root filesystem is exhausted.

Question 18

The exhibit shows the health check status for targets in an application load balancer's target group. The target group has a health check on port 80. An administrator notices that one target is unhealthy on port 80 but healthy on port 443. What is the most likely cause?

Accepted Answer

The security group for the target is blocking port 80 from the load balancer.. If the target is healthy on port 443 but unhealthy on port 80, the most likely cause is that the security group attached to the target is not permitting inbound traffic on port 80 from the load balancer. The health check on port 80 fails because the connection is blocked, while the 443 check succeeds because that port is allowed. This is a classic ALB target health troubleshooting scenario.

Answer

The web server on the target is not listening on port 443.

Answer

The load balancer is in a different VPC.

Answer

The health check path is incorrect.

Question 19

The exhibit shows VPC flow log entries for an EC2 instance (eni-12345678). The administrator is troubleshooting a connectivity problem where an application on 10.0.1.5 occasionally cannot connect to a web server at 10.0.2.10 on port 80. What action should the administrator take?

Accepted Answer

Add a network ACL rule allowing inbound TCP/80 from 10.0.1.5 to the subnet of 10.0.2.10.. VPC flow logs show REJECT entries for traffic destined to 10.0.2.10:80, which indicates a stateless network ACL is blocking the inbound request at the destination subnet boundary. Because NACLs are stateless and evaluated per-subnet, the administrator must add an inbound rule on the NACL protecting 10.0.2.10's subnet permitting TCP/80 from 10.0.1.5. Security groups are stateful and would have already allowed the return traffic if they were the culprit, and the flow log evidence points to a subnet-level deny.

Answer

Increase the MTU on the instance to 9001.

Answer

Add a security group rule allowing inbound TCP/80 from 10.0.1.5.

Answer

Add a route to the VPC route table for 10.0.1.5.

Question 20

A company is experiencing intermittent network connectivity issues between two cloud subnets. The cloud provider's monitoring shows no packet loss. Which troubleshooting step should be taken first?

Accepted Answer

Review the security group rules for both subnets. Security group rules can cause intermittent connectivity issues by selectively dropping traffic based on stateful inspection, timeouts, or misconfigured rules. Option B is wrong because virtual routers are typically managed by the provider and are unlikely to cause intermittent issues without alerts. Option C is wrong because increasing bandwidth does not address the underlying cause of intermittent drops. Option D is wrong because physical cabling is not relevant in the cloud.

Answer

Replace the virtual routers

Answer

Increase the bandwidth between subnets

Answer

Check the physical cabling