CV0-004 Troubleshooting Practice Question
An organization has a site-to-site VPN connection between its on-premises network and a cloud VPC. Users report intermittent connectivity to applications hosted in the cloud. The administrator checks the VPN tunnel status and sees it is up. However, ping tests from on-premises to a cloud instance fail at random times. Which factor should the administrator investigate first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPN tunnel is experiencing packet loss due to a mismatch in the IPSec parameters.
Intermittent connectivity with the VPN tunnel appearing up is a classic sign of packet loss or misconfiguration in IPSec parameters (e.g., mismatched phase 1/phase 2 settings, encryption algorithms, or Diffie-Hellman groups). This causes some packets to fail while others pass, leading to intermittent issues. Option A is incorrect because while the on-premises firewall blocking outbound ICMP could cause ping failures, it would not cause intermittent connectivity for all applications; also, the issue is likely VPN-related. Option B is incorrect because a security group blocking ICMP would cause consistent ping failure, not intermittent. Option C is incorrect because missing routes would cause complete failure for all traffic, not intermittent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The on-premises firewall is blocking outbound ICMP.
Why it's wrong here
This would cause consistent failure for ping, but not necessarily for other applications.
- ✗
The security group on the cloud instance is blocking ICMP.
Why it's wrong here
Blocking ICMP would cause consistent failure, not intermittent.
- ✗
The routing tables on the cloud VPC are missing routes for the on-premises network.
Why it's wrong here
Missing routes would cause complete failure, not intermittent.
- ✓
The VPN tunnel is experiencing packet loss due to a mismatch in the IPSec parameters.
Why this is correct
Mismatched IPSec parameters can cause intermittent connectivity despite the tunnel appearing up.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.