CV0-004 Troubleshooting Practice Question
A company has a three-tier application in a cloud VPC: web servers in a public subnet, application servers in a private subnet, and database servers in a private subnet. The web servers can connect to the application servers, but the application servers cannot connect to the database servers. The security groups are configured as follows: - Web SG: inbound HTTP from 0.0.0.0/0, outbound all - App SG: inbound HTTP from Web SG, outbound all - DB SG: inbound MySQL from App SG, outbound all What is the most likely cause of the connectivity issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.
Security groups are stateful and allow return traffic automatically, so outbound rules are not the issue. The inbound rule on DB SG allows MySQL from App SG, so A is not the issue. B is not needed because outbound is all. D is irrelevant because web SG does not affect traffic between app and DB. The issue likely is a network ACL (NACL) on the database subnet, which is stateless and needs explicit inbound and outbound rules; if it blocks inbound MySQL from the app subnet, the connection fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The database security group is missing an inbound rule for MySQL.
Why it's wrong here
The DB SG has an inbound rule for MySQL from App SG, so this is not the issue.
- ✗
The application security group is missing an outbound rule for MySQL.
Why it's wrong here
Security groups are stateful; outbound traffic is automatically allowed if inbound is permitted.
- ✓
The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.
Why this is correct
NACLs are stateless, so they must have explicit rules for traffic. A missing rule can block connectivity.
- ✗
The web security group is blocking traffic to the database.
Why it's wrong here
The web SG is not involved in app-to-db traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.