easyMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Migrating its on-premises e-commerce application…
A company is migrating its on-premises e-commerce application to a public cloud provider. The application consists of a web tier, an application tier, and a database tier. The cloud architect has designed a three-tier architecture using virtual machines (VMs) in a virtual private cloud (VPC). During the deployment, the web servers are placed in a public subnet, the application servers in a private subnet, and the database servers in a separate private subnet. All security groups and network ACLs have been configured to allow the required traffic. After deploying the application, the operations team reports that the web servers cannot communicate with the application servers. The web servers are able to reach the internet, and the application servers can be reached from the operations team's management bastion host. Which of the following is the MOST likely cause of the issue?
⚠ Common exam trap
CompTIA often tests the misconception that security groups or network ACLs are the primary cause of connectivity issues between subnets, when in reality the missing route in the subnet's route table is the root cause, especially when internet access works but inter-subnet communication fails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table associated with the web servers' subnet is missing a route to the application servers' subnet.
The web servers are in a public subnet with a route table that typically includes a default route (0.0.0.0/0) pointing to an internet gateway, enabling internet access. However, for the web servers to reach the application servers in a private subnet, the route table associated with the web servers' subnet must also contain a route to the destination CIDR block of the application servers' subnet, pointing to a local route or a virtual private cloud (VPC) peering connection. Without this explicit route, traffic from the web servers to the application servers is dropped because the route table does not know how to forward packets to that subnet, even though security groups and network ACLs are correctly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table associated with the web servers' subnet is missing a route to the application servers' subnet.
Why this is correct
Correct: Without a route to the private subnet, traffic is dropped.
- ✗
The web servers do not have a route to the internet gateway.
Why it's wrong here
Incorrect: The web servers can reach the internet, so the route to IGW is functional.
- ✗
The network ACL on the application servers' subnet is blocking inbound traffic from the web servers.
Why it's wrong here
Incorrect: If NACLs were blocking, the bastion host (same subnet) would also be blocked.
- ✗
The security group on the web servers is blocking outbound traffic to the application servers.
Why it's wrong here
The web servers can already reach the internet, proving their outbound security group rules permit traffic to external destinations; the failure is specifically with traffic to the application servers’ private subnet. A security group on the web servers blocking outbound traffic would prevent all outbound connections, including to the internet, which contradicts the reported symptom. This option is tempting because security groups do control outbound traffic, and in a scenario where web servers could not reach any external or internal target, a restrictive outbound rule would be the correct diagnosis.
Visual reference
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.