CV0-004 Troubleshooting Practice Question
A company uses a multi-cloud strategy with workloads on AWS and Azure. An application running on an Amazon EC2 instance in a VPC uses an Azure SQL Database as its backend via a site-to-site VPN. Recently, users reported intermittent timeouts when accessing the application. The EC2 instance passes health checks, and the VPN tunnel status shows as 'UP' from both sides. The application logs show 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' Which of the following is the MOST likely cause of the issue?
⚠ Common exam trap
The trap here is that candidates see a VPN tunnel status of 'UP' and assume connectivity is fully functional, overlooking that Azure SQL Database has its own separate firewall layer that must explicitly permit the source IP address of the connecting client.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Azure SQL Database firewall does not allow traffic from the EC2 instance's IP address or the VPN gateway's IP.
The error message 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' indicates that the Azure SQL Database server rejected the connection attempt. Since the VPN tunnel is 'UP' and the EC2 instance passes health checks, the most likely cause is that the Azure SQL Database firewall rules do not include the source IP address of the traffic coming from the EC2 instance — either the EC2 instance's private IP (if traffic is routed through the VPN) or the public IP of the VPN gateway. Azure SQL Database uses server-level firewall rules to allow client IP addresses, and without an explicit rule, all connections are blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EC2 instance has exhausted its CPU credits, causing the application to become unresponsive.
Why it's wrong here
CPU exhaustion would not produce a SQL login error; the application would likely report timeouts or latency, not a specific login failure.
- ✓
The Azure SQL Database firewall does not allow traffic from the EC2 instance's IP address or the VPN gateway's IP.
Why this is correct
Azure SQL has a firewall that must explicitly permit the source IP. The error 'login failed' often indicates the IP is blocked. The admin should add the VPN gateway's public IP to the allowed list.
- ✗
The VPN tunnel is not properly routing traffic to Azure, causing intermittent connectivity.
Why it's wrong here
The VPN status is UP, and the issue is a login failure, not a connectivity failure. Routing would show as unreachable, not a login error.
- ✗
The EC2 instance does not have sufficient IAM permissions to connect to Azure SQL Database.
Why it's wrong here
IAM permissions apply to AWS resources, not Azure. Azure SQL uses SQL authentication or Azure AD, not AWS IAM.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.