easyMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit.
```
$ cloud-cli compute instances describe --instance-id i-12345
{
"instanceId": "i-12345",
"state": "running",
"instanceType": "t2.medium",
"networkInterfaces": [
{
"ip": "10.0.1.25",
"subnetId": "subnet-abc",
"vpcId": "vpc-xyz",
"securityGroups": ["sg-web"]
}
],
"blockDeviceMappings": [
{
"deviceName": "/dev/sda1",
"volumeId": "vol-111",
"status": "attached"
}
]
}
```Refer to the exhibit. A cloud administrator runs the command to inspect an instance and notices that it is running, but the web application hosted on it is unreachable from the internet. The instance is in a public subnet with an internet gateway attached to the VPC. Which of the following is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instance's security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.
The instance has a security group named "sg-web" which likely does not allow inbound HTTP/HTTPS traffic from the internet. Other options are less plausible given the configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance type t2.medium does not support public IP addresses.
Why it's wrong here
t2.medium supports public IP addresses; the instance likely has a public IP if in a public subnet.
- ✓
The instance's security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.
Why this is correct
Correct. Security group rules control inbound traffic; missing HTTP/HTTPS rules would prevent internet access.
- ✗
The subnet subnet-abc is not associated with a route table that has a route to the internet gateway.
Why it's wrong here
The stem states the internet gateway is attached to the VPC, but the subnet route table may still be misconfigured; however, security group is a more common first check.
- ✗
The volume vol-111 is not encrypted.
Why it's wrong here
Volume encryption does not affect network reachability.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CV0-004
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A cloud administrator is troubleshooting an issue where a virtual machine (VM) cannot connect to the internet. Which TWO of the following are valid first steps to diagnose the problem?
easy- ✓ A.Verify the VM's network interface is attached to the correct subnet.
- B.Check the VM's OS firewall settings.
- C.Create a new VM.
- ✓ D.Check the VM's security group rules.
- E.Reboot the VM.
Why A: Verifying the VM's network interface is attached to the correct subnet is a fundamental first step in diagnosing internet connectivity issues. If the VM is on an isolated or mismatched subnet, it cannot route traffic to the internet gateway, regardless of other configurations. This check ensures the VM's virtual NIC is connected to the appropriate virtual network and subnet that has a route to the internet. Option D is also correct because checking the VM's security group rules is another essential first step. Security groups act as a virtual firewall controlling inbound and outbound traffic at the network interface level. If the security group rules do not allow outbound traffic to the internet (e.g., missing default outbound rule or overly restrictive rules), the VM will be unable to connect to the internet. Checking these rules early can quickly identify misconfigurations that block internet access. Together, verifying subnet attachment and security group rules are two of the most appropriate initial diagnostic steps, as they address the network-level controls that directly impact connectivity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.