CCNA Troubleshooting Questions

Geographic restrictions are enforced through load balancer ACLs, which filter client source IP ranges independently of backend health. Since health checks pass, the backend is fine; the ACL is the layer silently dropping traffic from the supposedly allowed region.

Security groups and network ACLs act as stateful or stateless packet filters; if the database listener port (for example 3306 or 5432) is not permitted inbound from the client subnet, connection attempts time out even though the instance itself is healthy and running.

Relocating /var/log/app onto the /data partition and symlinking it back frees the root filesystem permanently, since logs then consume /data's capacity instead. This satisfies the long-term requirement, unlike log rotation or deletion, which only delay reoccurrence as logs regrow.

High inter-zone network latency directly delays log shipping from primary to replica, so each replica applies writes later than the primary commits them. Since the replicas sit in different availability zones, cross-zone round-trip time is the bottleneck driving the observed replication lag, not write volume alone.

A misconfigured package repository prevents the cloud-init script from installing required packages, so initialisation halts before completion. This directly satisfies the stem's constraint: the VM launched but never finished bootstrapping, indicating a dependency fetch failure rather than a provisioning or networking fault.

When cross-zone load balancing is enabled, the load balancer should distribute traffic across all availability zones. However, if instances in other zones fail health checks, they are marked as unhealthy and removed from the target group's rotation, causing all traffic to go to healthy instances in only one zone.

The pipeline halts at the test stage, so the failure detail resides in that stage's output. Reviewing the test logs reveals the specific assertion, dependency or environment error before any remediation, avoiding speculative changes to code or pipeline configuration that could mask the actual fault.

The --previous flag retrieves logs from the previous instance of a container in a pod that has restarted. In a CrashLoopBackOff scenario, the current container may not have produced logs yet, but the previous instance likely contains the error that caused the crash. This command is essential for diagnosing why the container is failing to start.

High disk I/O wait with low CPU indicates the storage subsystem is the bottleneck. Cloud VMs have limits on IOPS and throughput. If the disk queue is saturated, increasing provisioned IOPS (if using a cloud disk like AWS EBS or Azure Disk) can improve performance. Checking queue depth helps confirm the bottleneck before making changes.

High CPU ready time means vCPUs wait in the hypervisor's run queue before receiving physical CPU cycles. Over-provisioning vCPUs across guests on the same host oversubscribes physical cores, so each VM waits longer, presenting as an unresponsive guest.

Security groups are stateful and already permit port 3306, so the next layer to verify is the stateless network ACL on the RDS subnet, which must allow inbound 3306 and outbound ephemeral return traffic. This satisfies the requirement to check the next likely blocker.

Network ACLs are stateless subnet-level filters separate from security groups. Even with security groups allowing traffic, an inbound rule in VPC B's NACL denying ICMP would silently drop echo requests, explaining why instances in VPC A cannot ping VPC B.

Redis CPU at 90% and memory at 95% indicate the cache cluster is saturated, so session lookups slow or fail, cascading into high load balancer latency and fluctuating healthy hosts. This satisfies the observed bottleneck, since compute CPU and memory remain moderate.

Insufficient VPN bandwidth saturates the tunnel during large backup transfers, causing TCP retransmissions and eventual timeout errors despite the VPN remaining up and stable. A relational database's daily full or incremental backup volume can exceed the tunnel's throughput, so the constraint of a stable-but-limited VPN link is satisfied by this explanation.

Upgrading to a higher-performance SSD volume type, such as provisioned IOPS SSD, can significantly reduce disk I/O wait times by providing more IOPS and lower latency. This is a direct solution when the current volume type is the bottleneck. The administrator should evaluate the workload's IOPS requirements and choose an appropriate volume type. This action addresses the root cause of high I/O wait.

High CPU ready time means the VM waited for physical cores while the scheduler ran other vCPUs. That occurs when the host's physical CPU is overcommitted, so the hypervisor cannot grant cycles promptly, directly explaining the slow VM.

Low CPU indicates the database itself is not the bottleneck, so the added round-trip latency between application and cloud-managed database is the likely cause. Moving off-premises lengthens the network path, slowing query response even when processing is idle.

Security groups are stateful and already permit MySQL from the App SG, so the block must come from the stateless layer: the database subnet's NACL. Its inbound rules are evaluated independently of outbound, and a missing allow for the application subnet's CIDR on port 3306 drops the traffic.

A 504 from the front end while API instances are healthy points to connectivity between tiers rather than an application crash. A security group or network ACL that silently drops the web-to-API flow would let the target group health check pass (if it originates inside the API subnet) while user requests time out. Checking these rules first is the fastest way to confirm or eliminate a network path fault.

After failover the read-write endpoint's DNS record points to the new primary, but a connection pool caching the old address keeps reconnecting to the failed node until its entries expire. This explains the outage far exceeding the two-minute failover time.

Checking VPN bandwidth and latency directly addresses the hybrid cloud bottleneck: the 100 Mbps on-premises link and any tunnel overhead cap throughput for cloud file access. Measuring both reveals whether encryption, routing or congestion is throttling transfers, satisfying the stem's constraint of diagnosing slow cloud file access across the hybrid connection.

The SP metadata was updated 45 days ago, but the IdP rotated its signing certificate 30 days ago. SAML signature validation relies on the certificate in the SP's trusted metadata; if it still holds the old certificate, assertions signed with the new key fail validation. This matches the symptom of successful IdP authentication but SP-side signature errors, and the timing discrepancy confirms the metadata is stale.

High CPU ready time indicates the VM is waiting for physical CPU resources because the hypervisor is oversubscribed. Moving the VM to a dedicated host or a host with lower oversubscription reduces contention, directly addressing the root cause. This is the most appropriate first step because it targets the resource bottleneck without unnecessary changes to the VM's configuration.

esxtop runs on the ESXi host itself, exposing per-world CPU scheduling metrics such as %RDY, which directly quantifies the time a vCPU waits for physical cores. This satisfies the stem's requirement to identify CPU contention at the hypervisor layer, unlike guest-level tools that cannot see host scheduling pressure.

Policy-as-code evaluates resource definitions against tagging rules and triggers automatic remediation, applying missing cost centre and environment tags. This enforces the governance requirement continuously rather than relying on manual audits, satisfying the automatic remediation constraint.

HTTP 503 signals backend capacity exhaustion, so the load balancer has healthy targets but insufficient compute. Adding VMs to the backend pool increases aggregate capacity to absorb the traffic spike, directly addressing the overload causing the errors.

The subscription's snapshot quota has been exhausted, meaning the maximum number of snapshots permitted for that region or resource group is already allocated. The error explicitly names the quota for the snapshots resource, so the limit itself is the blocker. Deleting unused snapshots or requesting a quota increase resolves the failure.

502 errors occur when the load balancer cannot establish a connection to a healthy target. If health checks are misconfigured (e.g., wrong path or port), targets are marked unhealthy and removed from rotation. When all targets are unhealthy, the load balancer returns 502. Correcting health check settings ensures only healthy targets receive traffic.

Latency-based routing selects the region with the lowest measured latency, so a misconfigured or stale policy would explain Asian users being sent to Europe despite healthy Asian resources. Investigating this policy first satisfies the stem's routing anomaly, since resource health and DNS resolution are already confirmed working.

High latency with low CPU, memory, and network utilization often points to storage I/O bottlenecks. If the application performs frequent disk reads/writes, slow disk I/O can cause delays. Cloud monitoring may not show disk latency by default, so it is a prime suspect when other metrics are normal.

Increasing memory directly resolves OOM errors without application changes.

A soft reboot (if supported) or hard reboot from the console can restart the OS without losing the VM's persistent disk data. This is the least disruptive action to regain access when the OS is hung but the VM is still running. It avoids data loss on attached volumes.

Resuming with `virsh resume` restores a paused domain without rebooting, preserving memory state and avoiding downtime. The stem's constraint—a critical VM requiring rapid restoration—favours this over restarting, which would discard in-memory data and lengthen recovery. Paused VMs remain intact, so resumption is the fastest safe first action.

Guest-level CPU consumption with no external workload points to something executing inside the operating system. A runaway or looping process is the most direct explanation and is checked first via Task Manager or top before examining host-level metrics or hypervisor scheduling.

With CoreDNS logging no errors, the fault likely lies in the pod's own DNS configuration. The container's /etc/resolv.conf supplies the nameserver and search domains used for lookups, so an incorrect or missing entry there would break name resolution despite healthy cluster DNS.

High latency during peak hours may stem from CPU or memory saturation on the web servers themselves. Monitoring both metrics reveals whether instances are resource-constrained, which would prevent the auto-scaling group from serving requests promptly behind the load balancer.

SSH works because INPUT accepts it, but forwarding relies on the FORWARD chain. A default DROP policy with no ACCEPT rules silently discards packets traversing the VM, so inter-interface traffic never passes despite routing being enabled.

Container runtimes tie the container lifecycle to the foreground process. When an entrypoint script launches a daemon that backgrounds itself, the foreground process exits, the runtime treats the container as complete, and the orchestrator restarts it. The fix is to run the process in the foreground or use a supervisor that keeps a foreground process alive.

Spreading instances across three availability zones means a single zone outage leaves two zones serving traffic, and the load balancer health checks route around the failed zone. This satisfies the requirement for resilience to the failure of an entire availability zone, which a single-zone or two-zone design cannot guarantee.

If the PVC requests an access mode (e.g., ReadWriteMany) that the underlying storage class does not support, the mount will fail. Checking compatibility ensures the volume can be attached to the pod. This is a common cause of FailedMount errors, especially with different storage backends like block vs. file storage.

An auto scaling group spanning both availability zones maintains capacity when one zone fails, replacing unhealthy instances in the surviving zone. This directly satisfies the high-availability constraint for the stateless web tier, since no session state pins users to a single instance.

VPC peering provides a direct private route between two VPCs, so its connection status must be Active before traffic can flow. A Pending, Rejected or Expired state blocks all routing regardless of route tables or security groups, directly satisfying the stem's same-region VPC-to-VPC connectivity requirement.

Intra-subnet pings succeeding proves the VM, OS and network path are healthy, isolating the fault to the security group. Modifying that group most likely removed or misconfigured the inbound HTTP/HTTPS rule, blocking internet clients while internal traffic continues.

High host CPU utilisation may be caused by the guest OS itself, so checking the VM console first distinguishes an OS-level hang or runaway process from genuine hypervisor contention. This is the least disruptive diagnostic step before migrating or restarting the VM.

Asynchronous replication commits on the primary without waiting for the standby, so inter-region network latency directly manifests as replication lag. Sustained latency prevents the standby from ever catching up, which is the expected failure mode for cross-region async setups.

High CPU ready time measures the percentage of time a virtual machine was ready to run but waited for a physical core. Sustained high values directly indicate CPU contention on the host, satisfying the stem's requirement for a metric evidencing contention.

System logs on the VM can reveal application crashes, kernel panics, or resource exhaustion events that correlate with the unavailability. Checking logs around the reported times is a fundamental troubleshooting step to identify patterns or specific errors. This action is non-intrusive and can quickly point to the root cause, such as a service restarting or running out of memory.

Stripping adds parallelism, reducing queue depth and improving latency.

Load balancer access logs typically include the backend instance that handled each request and the response time. By analyzing these logs, the administrator can identify if a particular instance has higher response times than others. This is a direct way to confirm which virtual machine is performing poorly without disrupting the service. Other methods may require more invasive actions or may not provide per-instance data.

The 1 Gbps interface cap is the bottleneck: periodic 500 Mbps outbound spikes plus burst overhead can saturate it, causing throttling and packet loss. A larger instance size raises the network bandwidth cap to 2 Gbps, removing that ceiling so peak traffic no longer queues at the interface.

Memory ballooning reveals host memory pressure: the hypervisor reclaims guest pages via the balloon driver, forcing the VM to swap and stall. Rising ballooning indicates the host is overcommitted on RAM, making it a direct contention signal alongside CPU ready time.

Serverless functions that call external databases are highly sensitive to network latency and database responsiveness. If the database is slow to respond or connections are timing out, the function will exceed its timeout. This is a common cause of intermittent timeouts in serverless architectures, especially when the database is outside the cloud provider's network or under heavy load.

Session persistence pins each client to the backend that first served it, so subsequent requests bypass normal distribution algorithms. With all servers healthy, this stickiness explains the uneven spread described in the stem rather than any health-check or capacity issue.

Sustained high disk queue depth together with saturated provisioned IOPS points directly to a storage throughput ceiling, not to CPU or query logic. Write operations depend on durable storage commits, so they stall when the volume cannot absorb the write rate, while reads served from a replica with its own volume stay fast. Raising provisioned IOPS addresses the measured constraint.

A 400 response signals client-side request rejection, and the response body carries the precise validation failure, such as an invalid name, unsupported region, or SKU mismatch. Reading those details identifies the offending property before any retry or script change is attempted.

Ping succeeding proves the network path, security group rule and routing are functional, so the fault lies above layer 3. A stopped or crashed web server process means nothing listens on port 80, producing connection refusals despite reachable IP connectivity.

Insufficient memory forces the operating system to page data from RAM to disk, and that swapping introduces severe latency because disk access is orders of magnitude slower than memory. With memory at 95% while CPU sits below 30%, the bottleneck is memory pressure, not processing capacity, so adding RAM resolves the slowdown.

Standard network-attached storage often has lower IOPS and higher latency compared to SSD-based volumes. Upgrading to a provisioned IOPS SSD or general-purpose SSD volume can significantly reduce latency and increase throughput. This directly addresses the performance bottleneck by providing faster storage media and potentially higher IOPS limits, which is the most effective solution for high disk I/O latency.

When a downstream dependency slows from milliseconds to seconds, worker threads spend most of their time waiting, so the pool fills and queued requests wait even longer. CPU stays low because threads are blocked on I/O, not computing. The growing external API latency is the trigger, and the thread pool saturation amplifies it across the service.

A failing readiness or liveness probe causes Kubernetes to remove pods from Service endpoints or restart them, leaving no healthy backends to serve traffic, so the ingress returns 503. This directly matches the scenario: a new version deployed, private-cloud Kubernetes, and users receiving 503 errors.

The container memory limit is 1Gi, but the Java heap is set to 768Mi. The JVM requires additional memory beyond the heap for metaspace, thread stacks, code cache, and native memory. This overhead can easily exceed 256Mi, pushing total memory usage above the 1Gi limit. When the container exceeds its limit, the kernel OOM killer terminates the process, resulting in 'OOMKilled' status. The node has available memory, so the issue is the container limit, not node pressure.

VPC flow logs capture metadata about IP traffic to and from network interfaces in a VPC, including source/destination IPs and bytes transferred. Filtering for outbound traffic to the third-party API's public IPs will reveal which instances are generating the most egress and confirm whether the increase is due to API calls or other traffic. This is the most direct first step to localize the source before deeper packet analysis.

Queue depth measures outstanding I/O requests awaiting service, and latency measures response time. Both rising together shows requests are queuing faster than the SSD/HDD mix can serve them, isolating the storage subsystem rather than CPU, network or application as the bottleneck.

Quota is per resource type, not aggregate, so overall headroom can exist while one service limit is exhausted. The deployment fails because that specific resource type has hit its ceiling, satisfying the 'Resource limit exceeded' error.

Security groups are stateful and evaluated per source. Because the bastion host on the same subnet succeeds while web tier instances in a different subnet time out, the database's inbound rule likely scopes the permitted source to the bastion's subnet or IP rather than the web tier CIDR. Adding the web tier subnet on the correct database port resolves the timeout.

A high number of receive drops on a virtio interface often indicates that the receive ring buffer is full. When packets arrive faster than the guest can process them, the buffer overflows and packets are dropped. This is common in virtualized environments where the virtio driver's ring size may be default and insufficient for high throughput. Increasing the ring buffer size using ethtool -G can mitigate the issue, and low CPU utilization suggests the guest is not overwhelmed, pointing to buffer capacity.

Network ACLs are stateless and evaluated per subnet, unlike security groups. The database subnet's ACL must permit inbound traffic on the database port and outbound return traffic to the EC2 subnet's ephemeral range, or packets are dropped before reaching the database.

Network latency directly affects request round-trip time between application and database tiers, a bottleneck CPU and memory metrics cannot reveal. Since the stem confirms compute resources are normal, measuring inter-tier latency isolates transport delay or congestion as the cause of slow responses, satisfying the need to identify non-compute performance constraints.

Packet loss on a Direct Connect virtual interface most commonly stems from a flapping or down BGP session, which withdraws routes and drops traffic. Verifying the BGP session status between the on-premises router and the AWS endpoint is the fastest first diagnostic step.

The security group allows inbound traffic on ports 22 and 80, but the application is listening on port 8080. Since users are trying to access the application via its public IP, they are likely using a URL without specifying port 8080 (e.g., http://public-ip), which defaults to port 80. However, even if they specified port 8080, the security group would block it because only ports 22 and 80 are allowed. The local curl to localhost:8080 works because it bypasses the security group. Thus, the security group is the most likely cause.

A custom image carries a hypervisor compatibility level set by the host that created it. If that level exceeds the destination host's hypervisor version, the platform rejects deployment, producing exactly this incompatibility error. The image must be recreated on an equal or older hypervisor.