Knowledge + Practice

CCNA Cloud Troubleshooting Questions

75 of 97 questions · Page 1/2 · Cloud Troubleshooting topic · Answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

A company uses a cloud-based load balancer to distribute traffic to web servers. Recently, a new security policy was applied that restricts traffic to certain geographic regions. Users from an allowed region report they cannot access the website. The load balancer status shows health checks are passing. What should the administrator check?

A.The DNS resolution for the website

B.The SSL certificate expiration

C.The web server logs for application errors

D.The load balancer's access control lists (ACLs)

AnswerD

ACLs enforce geographic restrictions and could be misconfigured, blocking allowed regions.

Why this answer

Geographic restrictions on a load balancer are typically implemented via access control lists (ACLs). Since health checks are passing, the web servers are functional, so the issue lies in the load balancer's ACLs blocking traffic from the allowed region. Option A is wrong: DNS resolution would affect all users similarly, not just those from a specific region.

Option B is wrong: SSL certificate issues would generate browser warnings or errors, not complete inaccessibility. Option C is wrong: web server logs are irrelevant as the traffic is not reaching the servers due to the ACL block.

Practice this question →

2

MCQmedium

A cloud administrator is starting the nginx web server on a new cloud VM but it fails. According to the exhibit, what is the most likely cause of the failure?

A.Another service is already listening on port 80

B.The VM does not have network connectivity

C.SELinux is blocking nginx from binding to the port

D.The nginx configuration file has a syntax error

AnswerA

The error explicitly states address already in use.

Why this answer

The error 'bind() to 0.0.0.0:80 failed (98: Address already in use)' indicates that port 80 is already occupied by another process. Option A is correct. Option B is wrong because SELinux would give a permission denied error, not address in use.

Option C is wrong because the error says address in use, not file not found. Option D is wrong because the error is about binding, not about configuration syntax.

Practice this question →

3

Multi-Selecthard

Which THREE are common reasons why a cloud database instance may become unreachable?

Select 3 answers

A.Firewall rules blocking the database port

B.Incorrect connection string in the application

C.Storage volume is full on the database server

D.Database service not started

E.Hypervisor maintenance causing VM reboot

AnswersA, B, D

Security groups or firewalls can block inbound traffic.

Why this answer

The three most common reasons a cloud database instance becomes unreachable are firewall rules blocking the database port (A), an incorrect connection string in the application (B), and the database service not being started (D). A full storage volume (C) may cause write failures but does not always result in unreachability, and hypervisor maintenance (E) typically uses live migration to avoid downtime.

Practice this question →

4

MCQhard

A company runs a critical e-commerce application on a private cloud using OpenStack. The application consists of web servers, application servers, and a MySQL database running on separate VMs. Recently, users have reported intermittent 502 Bad Gateway errors during peak hours. The operations team notices that the web server VMs show high CPU ready times and the application server VMs have increased network latency. Storage performance also shows high await times on the SSD-based Ceph cluster. The team suspects resource contention. Which of the following is the BEST course of action to diagnose and resolve the issue?

A.Migrate the web server VMs to a different compute host using live migration.

B.Increase the number of vCPUs for each web server VM to reduce CPU ready time.

C.Implement quality of service (QoS) policies on the Ceph cluster to guarantee IOPS for the database.

D.Review the hypervisor's CPU and memory allocation ratios and adjust overcommitment settings.

AnswerD

Reviewing and adjusting hypervisor CPU and memory allocation ratios directly addresses the root cause of overcommitment, reducing contention across CPU, memory, and storage.

Why this answer

High CPU ready times and overall contention indicate overcommitment on the hypervisors. Adjusting overcommitment ratios can reduce contention across CPU, memory, and storage. Option A is incorrect because migrating VMs to a different host is a temporary workaround that does not address the root cause of overcommitment.

Option B is incorrect because adding more vCPUs can worsen contention by increasing scheduling overhead. Option C is incorrect because QoS policies on storage only address storage contention and do not resolve CPU or network issues.

Practice this question →

5

Drag & Dropmedium

Sequence the steps to set up a cloud storage bucket with versioning and lifecycle policies.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Create bucket, enable versioning, add lifecycle rules for transitions and deletions, then test.

Practice this question →

6

MCQmedium

A cloud engineer receives an alert that the root filesystem (/) is at 93% usage. The /data volume has plenty of free space. The application stores logs in /var/log/app/ on the root filesystem. Which of the following is the BEST long-term solution?

A.Move the /var/log/app directory to the /data partition and create a symlink

B.Increase the size of the root filesystem

C.Delete the /data partition and merge it with root

D.Configure log rotation to delete logs more frequently

AnswerA

This frees root space and leverages the /data volume's capacity.

Why this answer

Moving the /var/log/app directory to the /data partition and creating a symlink is the best long-term solution because it permanently relocates the log data to a volume with ample free space without requiring application reconfiguration. The symlink (/var/log/app -> /data/app) makes the application continue to write to the same logical path, while the actual storage is on the /data filesystem. This resolves the root filesystem capacity issue without altering the application's logging behavior or risking data loss.

Exam trap

CompTIA often tests the misconception that increasing filesystem size or deleting partitions is a valid long-term fix, when in reality the correct approach is to relocate data to a separate volume using a symlink or mount bind.

How to eliminate wrong answers

Option B is wrong because increasing the size of the root filesystem only provides a temporary fix and does not address the underlying issue of log growth; it may also be impractical if the underlying disk or LVM has no free extents. Option C is wrong because deleting the /data partition and merging it with root is destructive, risks data loss on /data, and violates the principle of separating application data from the OS filesystem. Option D is wrong because configuring log rotation to delete logs more frequently reduces historical data needed for troubleshooting and compliance, and does not prevent future root filesystem exhaustion if log volume continues to grow.

Practice this question →

7

MCQhard

A cloud database cluster is experiencing replication lag. The primary node shows high write activity, and the replicas are on different availability zones. Which of the following is the most likely cause?

A.Replication is configured as synchronous.

B.Network latency between the primary and replica zones is high.

C.The replica nodes have insufficient storage.

D.The primary node's vCPU is over-allocated.

AnswerB

Geographic distance increases latency, causing replication lag.

Why this answer

Network latency between availability zones is a common cause of replication lag in asynchronous replication setups, especially when the primary has high write activity. Option A is incorrect because synchronous replication would cause the primary to wait for acknowledgment from replicas, leading to write slowdown rather than lag on replicas. Option C is incorrect because insufficient storage on replicas would typically cause disk-full errors, not replication lag.

Option D is incorrect because vCPU over-allocation on the primary primarily affects compute performance, not the replication process which is more sensitive to network and disk I/O.

Practice this question →

8

MCQhard

A cloud administrator is troubleshooting why a newly launched VM did not complete its initialization. According to the exhibit, what is the most likely cause?

A.Cloud-init is not installed on the VM

B.The package repository is not configured correctly

C.The cloud-init user data script contains a syntax error

D.The VM does not have internet access

AnswerB

The 'Unable to locate package' error typically means the repository list is outdated or missing.

Why this answer

The error 'E: Unable to locate package python3-pip' indicates that the package repository is not configured correctly or the package does not exist in the configured sources. This prevents cloud-init from installing the specified package, so the most likely cause is an incorrect repository configuration. Therefore, option B is correct.

Option A is incorrect because cloud-init is executing commands, showing it is installed. Option C is incorrect because the error is about a missing package, not a syntax error. Option D is incorrect because the command ran successfully, indicating no network issues; the problem is repository configuration.

Practice this question →

9

MCQhard

A web application is deployed across multiple availability zones behind a load balancer. The administrator notices that all traffic is being routed to instances in only one availability zone, causing performance issues. The load balancer is configured to distribute traffic across all zones evenly. What is the most likely cause?

A.The firewall rules for the load balancer only allow traffic from one zone.

B.The instances in the other zones are marked as unhealthy due to failing health checks.

C.The route table for the subnets in the other zones is missing a default route.

D.The listener rules are configured to forward traffic to a single backend pool.

AnswerB

When cross-zone load balancing is enabled, the load balancer should distribute traffic across all availability zones. However, if instances in other zones fail health checks, they are marked as unhealthy and removed from the target group's rotation, causing all traffic to go to healthy instances in only one zone.

Why this answer

When the load balancer is configured to distribute traffic across all zones, it should balance traffic across all availability zones. However, if instances in other zones fail health checks, they are marked as unhealthy and removed from the rotation, causing all traffic to go to healthy instances in only one zone. Option A is incorrect because firewall rules are not zone-specific; they apply to resources regardless of zone.

Option C is incorrect because route tables affect outbound traffic from instances, not load balancer traffic distribution. Option D is incorrect because a single backend pool can contain instances from multiple zones; this does not limit traffic to one zone.

Practice this question →

10

MCQeasy

A cloud administrator is troubleshooting a failed deployment of a new application version using a continuous integration/continuous deployment (CI/CD) pipeline. The pipeline fails at the 'test' stage. What is the first step the administrator should take?

A.Re-run the pipeline

B.Increase the timeout of the test stage

C.Roll back to the previous version

D.Check the test logs for specific errors

AnswerD

Logs reveal the exact cause, such as failed unit tests or configuration issues.

Why this answer

Checking the test logs for specific errors is the first step in troubleshooting a failed pipeline. It provides detailed information about what went wrong during the test stage. Option A is incorrect because re-running the pipeline without investigating the failure is unlikely to fix the underlying issue and wastes time.

Option B is incorrect because increasing the timeout does not address the root cause of the failure; it only delays the timeout, which may not be the problem. Option C is incorrect because rolling back should be done only after understanding the failure and deciding to revert, not as a first step.

Practice this question →

11

MCQmedium

A company is experiencing intermittent network connectivity issues between two cloud subnets. The cloud provider's monitoring shows no packet loss. Which troubleshooting step should be taken first?

A.Review the security group rules for both subnets

B.Replace the virtual routers

C.Increase the bandwidth between subnets

D.Check the physical cabling

AnswerA

Incorrect security group rules can block traffic between subnets intermittently based on timing or state.

Why this answer

Security group rules can cause intermittent connectivity issues by selectively dropping traffic based on stateful inspection, timeouts, or misconfigured rules. Option B is wrong because virtual routers are typically managed by the provider and are unlikely to cause intermittent issues without alerts. Option C is wrong because increasing bandwidth does not address the underlying cause of intermittent drops.

Option D is wrong because physical cabling is not relevant in the cloud.

Practice this question →

12

MCQeasy

A company is running a database server on a virtual machine in the cloud. The database team reports that write operations are taking longer than expected. The administrator checks the disk performance metrics and sees that the average disk queue length is consistently above 10. Which action would most likely resolve this issue?

A.Add more RAM to the virtual machine.

B.Upgrade to a higher IOPS tier for the disk.

C.Increase the size of the disk.

D.Enable compression on the database.

AnswerB

Upgrading IOPS tier increases throughput, reducing queue length.

Why this answer

A high disk queue length indicates that I/O requests are waiting, meaning the disk cannot keep up with the workload. Upgrading to a higher IOPS tier provides more throughput, reducing the queue length. Option A is wrong because adding RAM might reduce the number of disk reads due to caching, but write operations still require disk I/O and RAM does not directly increase I/O throughput.

Option C is wrong because increasing disk size does not inherently improve IOPS; it only adds more storage capacity. Option D is wrong because enabling compression reduces the amount of data written, which can lower I/O demand, but it does not directly address the queue length issue caused by insufficient IOPS.

Practice this question →

13

MCQmedium

A cloud administrator receives an alert that a virtual machine (VM) is unresponsive. The VM is hosted on a hypervisor that shows high CPU ready time. Which of the following is the most likely cause?

A.Insufficient memory allocated to the VM

B.Network latency between the VM and storage

C.Disk I/O contention from other VMs

D.Over-provisioning of vCPUs on the hypervisor

AnswerD

Correct; over-provisioned vCPUs cause contention and high ready time.

Why this answer

High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the hypervisor to schedule physical CPU time. This is a classic symptom of over-provisioning vCPUs, where the total number of vCPUs assigned to all VMs exceeds the available physical cores, causing contention at the hypervisor scheduler level.

Exam trap

The trap here is that candidates confuse high CPU ready time with high CPU usage or memory pressure, but ready time is a hypervisor-level scheduling delay, not a guest OS metric, and is directly tied to vCPU over-provisioning.

How to eliminate wrong answers

Option A is wrong because insufficient memory would typically cause swapping or ballooning, not high CPU ready time, which is a CPU scheduling metric. Option B is wrong because network latency between the VM and storage affects storage I/O latency, not CPU scheduling, and would manifest as high disk latency or queue depth. Option C is wrong because disk I/O contention from other VMs would result in high disk queue length or latency, not CPU ready time, which is a measure of CPU starvation.

Practice this question →

14

MCQhard

A cloud instance fails to initialize. The cloud-init log shows the error above. Which of the following is the most likely cause?

A.The filesystem on /dev/xvdb1 is not formatted with a recognized filesystem.

B.The disk is not attached to the instance at all.

C.The partition table on /dev/xvdb1 is corrupted.

D.The launch template specifies a block device mapping that is not attached to the instance.

AnswerD

The device /dev/xvdb1 is present in the mapping but not attached, causing mount failure.

Why this answer

The error 'No such device' indicates that the device specified in the block device mapping does not exist on the instance. Option D is correct because the launch template likely references a block device mapping for a device that is not actually attached (e.g., an ephemeral disk or misconfigured EBS volume). Option A is incorrect because an unformatted filesystem would produce a different error (e.g., 'mount: unknown filesystem type').

Option B is incorrect because if the disk were not attached at all, the device path would not appear in the system, but the error references a specific device path that is missing. Option C is incorrect because a corrupted partition table would yield errors like 'invalid partition table', not 'No such device'.

Practice this question →

15

MCQeasy

A user reports that they cannot connect to a RDS database instance from their application. The security group for the RDS instance allows inbound traffic on port 3306 from the application server's security group. What should the administrator check NEXT?

A.IAM policy attached to the RDS instance

B.Network ACL rules for the RDS subnet

C.Route table entries for the RDS subnet

D.Outbound security group rules on the RDS instance

AnswerB

Network ACLs act as a firewall at subnet level and can block inbound traffic.

Why this answer

The RDS security group already allows inbound traffic from the application server's security group, so the issue likely lies elsewhere. Network ACLs (NACLs) are stateless and apply to the subnet level; they must allow both inbound and outbound traffic in both directions for the connection. Checking NACL rules is the next step.

Option A is incorrect because IAM policies control access permissions, not network connectivity. Option C is incorrect because route tables primarily govern traffic between subnets and to the internet; within the same VPC, routes are typically not the cause of this issue. Option D is incorrect because outbound rules on the RDS instance affect traffic leaving the RDS, not incoming connections.

Practice this question →

16

Multi-Selecthard

A cloud administrator is troubleshooting a network connectivity issue between two VPCs connected via a VPC peering connection. The administrator has verified that the route tables are correct and that the security groups allow traffic. However, instances in VPC A cannot ping instances in VPC B. Which TWO of the following could be causing the issue? (Choose TWO.)

Select 2 answers

A.Network ACLs in VPC B are blocking inbound ICMP

B.Security groups in VPC A are blocking inbound ICMP

C.Host-based firewall on the target instance is blocking ping

D.VPC peering connection does not support ICMP

E.Route tables are misconfigured

AnswersA, C

Network ACLs are stateless; they must explicitly allow both inbound and outbound ICMP.

Why this answer

Network ACLs are stateless and must allow both inbound and outbound traffic; if they block inbound ICMP, ping fails, making A correct. Host-based firewall rules within the OS of the target instance can also block ICMP, making C correct. B is wrong because security groups in VPC A control inbound traffic to instances in VPC A, not to instances in VPC B.

D is wrong because VPC peering supports ICMP. E is wrong because the administrator verified route tables are correct.

Practice this question →

17

MCQhard

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

A.Migrate to a volume type with provisioned IOPS (SSD).

B.Increase the volume size to gain higher baseline IOPS.

C.Move the logs to an object storage service.

D.Enable write caching on the volume.

AnswerA

Provisioned IOPS SSD provides consistent high IOPS, eliminating write spikes.

Why this answer

Standard HDD volumes have low maximum IOPS and burst performance that is quickly exhausted under sustained writes, leading to write latency spikes. Migrating to a volume type with provisioned IOPS, such as SSD, provides consistent and higher write performance without requiring application changes. Option B is incorrect because increasing the volume size does increase baseline IOPS for HDD volumes, but the improvement is marginal and still relies on burst credits, which will be depleted again.

Option C is incorrect because moving logs to object storage changes the storage paradigm and would require application modifications to use different APIs. Option D is incorrect because write caching on a data volume is not recommended as it can lead to data loss in the event of a power failure, and caching is typically for read performance.

Practice this question →

18

MCQhard

A company runs a critical e-commerce application on a cloud platform. The architecture includes a load balancer in front of an auto scaling group of compute instances across two availability zones. The instances are in a private subnet and use a NAT gateway for outbound internet access. The application stores session data in a managed Redis cache cluster. During a flash sale, users report that the site is extremely slow and some requests time out. Monitoring shows the load balancer's latency metric is high, and the number of healthy hosts fluctuates. The CPU utilization on the compute instances averages 60% and memory averages 70%. The Redis cluster's CPU utilization is 90%, and its memory usage is 95%. The NAT gateway's metrics show high BytesOutToSource but no errors. Which of the following is the most likely cause of the performance issue?

A.The NAT gateway is throttling traffic due to bandwidth limits

B.The managed Redis cache cluster is overloaded and becoming a bottleneck for session lookups

C.The auto scaling group is not scaling quickly enough due to cooldown periods

D.The load balancer's idle timeout setting is too low, causing premature connection drops

AnswerB

The Redis cluster's high CPU and memory utilization directly impact session operations, causing latency and timeouts.

Why this answer

The managed Redis cache cluster is the most likely bottleneck because its CPU utilization is at 90% and memory usage at 95%, indicating it is near capacity. Since the application stores session data in Redis, high latency and timeouts during a flash sale are consistent with an overloaded session store that cannot keep up with request volume, causing the load balancer to experience increased latency and healthy host fluctuations as sessions fail to be retrieved or written.

Exam trap

The trap here is that candidates may focus on the NAT gateway or auto scaling group because they are common bottlenecks, but the key clue is the Redis cluster's high CPU and memory metrics, which directly correlate with session store performance issues in a stateful application.

How to eliminate wrong answers

Option A is wrong because the NAT Gateway shows high BytesOutToSource but no errors, and NAT Gateway bandwidth limits are typically high (up to 10 Gbps per AZ) and would cause packet drops or errors if throttled, not just high latency. Option C is wrong because the Auto Scaling group's cooldown periods could delay scaling, but the EC2 instances are only at 60% CPU and 70% memory, which are not saturated, so scaling is not the primary issue. Option D is wrong because the ALB's idle timeout setting (default 60 seconds) controls how long the ALB keeps a connection open without data; premature connection drops would manifest as immediate disconnects, not high latency and timeouts.

Practice this question →

19

MCQeasy

A company has a cloud-based application that uses a relational database. The database team performs daily backups to an on-premises storage system using a VPN connection. Recently, backups have been failing with timeout errors. The network team confirms the VPN is up and stable. Which of the following is the MOST likely cause?

A.The database service is not responding

B.The VPN bandwidth is insufficient for the backup data volume

C.The VPN tunnel is not properly configured

D.The on-premises firewall is blocking the backup port

AnswerB

Large backups can exceed VPN capacity, leading to timeouts.

Why this answer

The VPN connection is confirmed stable, so tunnel configuration and firewall issues are unlikely. Backup timeout errors with large data volumes typically indicate insufficient bandwidth, causing the transfer to exceed the timeout threshold. The database service itself is responding (backups are attempted), ruling out service unavailability.

Exam trap

The trap here is that candidates assume a stable VPN means the link has sufficient capacity, but CompTIA often tests the distinction between connectivity (layer 3) and throughput (layer 4/performance), where a stable tunnel can still be too slow for large data transfers.

How to eliminate wrong answers

Option A is wrong because if the database service were not responding, backups would fail immediately with a connection error, not a timeout after data transfer begins. Option C is wrong because the network team confirmed the VPN is up and stable, meaning the tunnel is properly configured and operational. Option D is wrong because a firewall block would cause a consistent failure (e.g., connection refused), not intermittent timeouts, and the VPN tunnel encrypts traffic, making port-specific blocking less likely.

Practice this question →

20

MCQeasy

A cloud administrator notices that a virtual machine (VM) is running slowly. The hypervisor shows high CPU ready time for that VM. Which of the following is the most likely cause?

A.High disk I/O latency on the datastore

B.Insufficient memory allocated to the VM

C.Overcommitted physical CPU resources on the host

D.Misconfigured virtual switch

AnswerC

Overcommitted CPU means the VM competes for physical cores, causing high ready time.

Why this answer

High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the physical CPU to become available. This is a classic symptom of CPU overcommitment, where the host has more virtual CPUs (vCPUs) assigned to VMs than physical cores, causing contention. Option C correctly identifies this as the most likely cause.

Exam trap

CompTIA often tests the distinction between CPU ready time and other performance metrics, trapping candidates who confuse high CPU ready time with memory pressure or storage latency.

How to eliminate wrong answers

Option A is wrong because high disk I/O latency would manifest as high disk queue depth or high kernel latency, not as CPU ready time. Option B is wrong because insufficient memory would cause ballooning or swapping, not CPU ready time. Option D is wrong because a misconfigured virtual switch would cause network connectivity issues or packet loss, not CPU scheduling delays.

Practice this question →

21

MCQmedium

During a cloud migration, a database server is moved from on-premises to a cloud-managed database service. After migration, the application team reports that some queries are running slower than before. The database CPU utilization is low. What is the most likely cause?

A.The network latency between the application and the database has increased

B.The database is not indexed properly

C.The database connection pooling is misconfigured

D.The cloud database instance type has insufficient memory

AnswerA

Higher latency increases query response time without affecting CPU.

Why this answer

Increased network latency between the application and the cloud database can slow query response times without raising CPU utilization. Option B is wrong: improper indexing forces full table scans, which typically increase CPU usage. Option C is wrong: misconfigured connection pooling usually leads to connection errors or timeouts, not consistently slow queries with low CPU.

Option D is wrong: insufficient memory causes swapping and high disk I/O, which would increase CPU usage.

Practice this question →

22

MCQmedium

A company has a three-tier application in a cloud VPC: web servers in a public subnet, application servers in a private subnet, and database servers in a private subnet. The web servers can connect to the application servers, but the application servers cannot connect to the database servers. The security groups are configured as follows: - Web SG: inbound HTTP from 0.0.0.0/0, outbound all - App SG: inbound HTTP from Web SG, outbound all - DB SG: inbound MySQL from App SG, outbound all What is the most likely cause of the connectivity issue?

A.The database security group is missing an inbound rule for MySQL.

B.The application security group is missing an outbound rule for MySQL.

C.The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.

D.The web security group is blocking traffic to the database.

AnswerC

NACLs are stateless, so they must have explicit rules for traffic. A missing rule can block connectivity.

Why this answer

Security groups are stateful and allow return traffic automatically, so outbound rules are not the issue. The inbound rule on DB SG allows MySQL from App SG, so A is not the issue. B is not needed because outbound is all.

D is irrelevant because web SG does not affect traffic between app and DB. The issue likely is a network ACL (NACL) on the database subnet, which is stateless and needs explicit inbound and outbound rules; if it blocks inbound MySQL from the app subnet, the connection fails.

Practice this question →

23

MCQmedium

An administrator notices that a cloud-hosted database is experiencing high latency during peak usage. The CPU and memory utilization on the DB server are below 50%, but disk IOPS are consistently at the provisioned limit. What should the administrator check first?

A.Check network bandwidth between the DB and application servers.

B.Add additional storage volumes and stripe data.

C.Check if the storage volume has an IOPS cap.

D.Increase the number of vCPUs on the DB server.

AnswerC

Saturating the IOPS limit causes queuing and high latency.

Why this answer

The symptoms (high latency, low CPU/memory utilization, but disk IOPS at provisioned limit) indicate the storage volume's IOPS cap is being hit, causing queueing and latency. Option A is incorrect because network bandwidth is not indicated as the bottleneck; CPU and memory are low, and latency is tied to disk. Option B is incorrect because adding storage volumes would not directly address the IOPS cap; it might spread load but does not increase the per-volume IOPS limit.

Option D is incorrect because increasing vCPUs would not resolve an IOPS limitation; the CPU is not saturated.

Practice this question →

24

MCQhard

A cloud administrator is troubleshooting a database failover issue. The database is a managed service with a primary and standby replica in different availability zones. The application uses a read-write endpoint. During a recent maintenance event, the primary database failed over automatically, but the application experienced a 10-minute outage. The administrator checks the failover logs and sees that it completed within 2 minutes. What is the most likely cause of the extended outage?

A.The application's database connection pool does not retry DNS resolution

B.The application was not configured to use multiple availability zones

C.The standby replica was not in sync

D.The failover triggered a change in the endpoint DNS record

AnswerA

Stale connections continue to point to the old primary IP, causing failures until the pool refreshes.

Why this answer

If the application's connection pool caches the IP address of the primary database, it will not automatically re-resolve the DNS after failover, causing prolonged outages. Option B is wrong because multi-AZ configuration is about the database, not the application's endpoint configuration. Option C is wrong because if the standby was out of sync, failover would not complete cleanly.

Option D is wrong because the DNS change is usually fast but the application may not re-query DNS.

Practice this question →

25

MCQmedium

A company migrated to a hybrid cloud and users report slow access to files stored in the cloud. The on-premises network is 100 Mbps. What troubleshooting step should be taken?

A.Enable compression on the cloud storage gateway

B.Check VPN bandwidth and latency

C.Increase cloud storage performance tier

D.Move files to on-premises storage

AnswerB

VPN bandwidth and latency directly affect file transfer speeds.

Why this answer

Slow file access over a hybrid connection is often due to limited VPN bandwidth or high latency. Option A is wrong because increasing storage performance tier may not address network bottlenecks. Option C is wrong because moving files back defeats the hybrid cloud purpose.

Option D is wrong because compression may help but isn't the first step to diagnose the issue.

Practice this question →

26

MCQeasy

A cloud engineer is troubleshooting performance issues in a virtualized environment. Which of the following tools would BEST help identify CPU contention on a hypervisor?

A.iperf

B.esxtop

C.ping

D.nslookup

AnswerB

Shows CPU metrics like ready time and co-stop.

Why this answer

'esxtop' (on VMware) provides real-time performance data including CPU ready time, which directly indicates CPU contention. Option A is incorrect because 'iperf' measures network throughput. Option C is incorrect because 'ping' tests basic connectivity.

Option D is incorrect because 'nslookup' is for DNS resolution.

Practice this question →

27

MCQeasy

Refer to the exhibit. An application running on an EC2 instance is failing to connect to an RDS database. What is the most likely issue?

A.The database instance is in a different VPC

B.The security group for the RDS instance does not allow inbound traffic from the EC2 instance

C.The database instance is stopped

D.The application is using the wrong database port

AnswerB

A security group denying inbound traffic causes a TCP reset, resulting in connection refused.

Why this answer

A 'connection refused' error typically indicates that the database is reachable but the port is blocked, likely by a security group. Option A is wrong if the database is in a different VPC, the error would be timeout or no route. Option C is wrong because a stopped database would result in a 'no route to host' or timeout.

Option D is wrong because port 3306 is standard for MySQL and the error is not about wrong port.

Practice this question →

28

MCQhard

A company is implementing a cloud governance strategy. They need to ensure that all resources are tagged with cost center and environment, and any untagged resources are automatically remediated. Which of the following best practices should be applied?

A.Implement role-based access control to restrict resource creation

B.Set up budget alerts to notify when costs exceed thresholds

C.Create a manual audit process to check tags weekly

D.Use policy-as-code to enforce tagging and automatically apply tags to untagged resources

AnswerD

Correct; policy-as-code can enforce and auto-remediate tagging.

Why this answer

Policy-as-code (e.g., Azure Policy, AWS Config Rules, or Open Policy Agent) allows you to define tagging requirements declaratively and automatically remediate non-compliant resources. This approach enforces governance in real-time without manual intervention, ensuring all resources are tagged with cost center and environment as specified.

Exam trap

The trap here is that candidates often confuse manual audit processes (Option C) with automated governance, failing to recognize that policy-as-code provides the required automatic remediation in real-time.

How to eliminate wrong answers

Option A is wrong because role-based access control (RBAC) restricts who can create resources but does not automatically tag or remediate untagged resources. Option B is wrong because budget alerts notify when costs exceed thresholds but do not enforce tagging or remediate untagged resources. Option C is wrong because a manual audit process is reactive, time-consuming, and does not provide automatic remediation, which is required by the question.

Practice this question →

29

Multi-Selecteasy

A cloud engineer receives alerts that a storage volume is reaching capacity. Which three immediate actions should the engineer consider? (Choose three.)

Select 3 answers

A.Attach additional volumes

B.Create a snapshot before making changes

C.Enable compression on the volume

D.Delete unnecessary files

E.Increase the size of the storage volume

AnswersA, D, E

Adding new volumes expands total storage instantly.

Why this answer

Correct options are A, D, and E. Option A is correct because attaching additional volumes increases total capacity immediately. Option D is correct because deleting unnecessary files frees up space quickly.

Option E is correct because increasing the size of the storage volume provides more space without data migration. Option B is incorrect because creating a snapshot is a precautionary backup step, not an immediate remedy for capacity issues. Option C is incorrect because enabling compression may not affect existing data and is not an immediate solution.

Practice this question →

30

MCQeasy

A cloud application returns HTTP 503 errors during high traffic. The application runs on VMs behind a load balancer. Which action is most likely to resolve the issue?

A.Restart the web server service on one VM.

B.Change the DNS TTL to a lower value.

C.Increase the health check interval on the load balancer.

D.Add additional VMs to the backend pool.

AnswerD

Scaling out increases capacity to handle traffic.

Why this answer

Adding VMs increases the overall capacity to handle high traffic, directly addressing the 503 errors caused by overload. Option A is incorrect because restarting only one VM does not increase capacity; it might briefly disrupt service. Option B is incorrect because lowering the DNS TTL affects how clients resolve the domain, not the backend capacity.

Option C is incorrect because increasing the health check interval only delays detection of unhealthy VMs, which does not prevent overload.

Practice this question →

31

MCQmedium

An automated snapshot of a cloud VM is failing with the error 'Quota exceeded for resource snapshots'. What is the most likely cause?

A.The snapshot is being created during a backup window.

B.The maximum number of snapshots allowed has been reached.

C.The snapshot retention policy is set too high.

D.The VM's disk is too full to create a snapshot.

AnswerB

Quota exceeded means the limit on number of snapshots is hit.

Why this answer

The error 'Quota exceeded for resource snapshots' indicates that the number of snapshots has reached the maximum allowed by the cloud provider. Therefore, Option B is correct. Option A is incorrect because backup windows do not affect snapshot quotas.

Option C is incorrect because a high retention policy may cause more snapshots to be retained, but the immediate error is about exceeding the quota, not the policy setting itself. Option D is incorrect because disk space is unrelated to the snapshot count limit.

Practice this question →

32

MCQmedium

A KVM host has three VMs. The db-server VM is in a paused state. Which of the following is the most likely cause?

A.Storage I/O error on the VM disk

B.CPU overcommitment on the host

C.Insufficient memory on the host

D.Network interface is down

AnswerA

Hypervisors pause VMs when storage errors occur to prevent corruption.

Why this answer

Storage I/O errors on the VM disk can cause the hypervisor to pause the VM to prevent data corruption. CPU overcommitment (Option B) typically leads to performance degradation, not pausing. Insufficient memory (Option C) can cause swapping or OOM, but not directly pausing.

A network interface being down (Option D) would affect connectivity, not cause the VM to enter a paused state.

Practice this question →

33

MCQhard

A global company runs a SaaS application in multiple cloud regions. They use DNS-based global load balancing to route users to the nearest region. Recently, users in Asia are experiencing high latency and timeouts. The administrator checks the health of the Asian region's resources and finds everything operational. Latency measurements from a monitoring tool show that traffic from Asian users is being routed to the European region. What should the administrator investigate first?

A.The latency-based routing policy

B.The DNS TTL settings

C.The geo-location records in the DNS provider

D.The load balancer configuration in the Asian region

AnswerA

Misconfiguration in latency-based routing can send traffic to a farther region.

Why this answer

The latency-based routing policy. Since the Asian region's resources are operational but traffic is being routed to Europe, the issue is likely that the latency-based routing policy is misconfigured or not accurately measuring latency from Asian users. This policy uses latency measurements to route users to the closest region; if it's flawed, traffic may be sent to a distant region.

Investigate the latency routing policy first. Option B (DNS TTL) affects caching duration, not routing decisions. Option C (geo-location records) is used for geographic routing, not latency-based routing.

Option D (load balancer in Asia) is operational, so the problem is at the DNS level, not the load balancer.

Practice this question →

34

MCQhard

Refer to the exhibit. A cloud engineer is using AzCopy to transfer files to Azure Blob Storage. The copy fails with the above error. Which of the following is the most likely cause?

A.The network throughput is insufficient

B.The SAS token used has expired

C.The storage account firewall is blocking the IP

D.The destination container does not exist

AnswerB

An expired SAS token causes the server to reject the request with this exact error.

Why this answer

The error explicitly indicates an authentication failure, which is typically due to an expired or invalid SAS token. Option A is wrong because a firewall block would result in a different error (e.g., 403 Forbidden). Option C is wrong because a non-existent container would return a 404 error.

Option D is wrong because insufficient throughput would cause a timeout, not an authentication error.

Practice this question →

35

Multi-Selecthard

A company is experiencing high latency in their cloud-based database. The database is provisioned with SSD storage. Which THREE factors should the administrator investigate? (Choose three.)

Select 3 answers

A.Network bandwidth between application and database

B.Database query optimization

C.Number of database replicas

D.Storage IOPS limits

E.Region latency

AnswersA, B, D

Network congestion or high latency affects database response.

Why this answer

Options A, B, and D are correct because network bandwidth limitations between application and database can cause high latency, unoptimized database queries increase response time, and exceeding IOPS limits leads to throttling and higher latency. Option C is incorrect because the number of database replicas primarily affects read throughput and fault tolerance, not latency directly. Option E is incorrect because region latency is a fixed infrastructure property that typically does not change suddenly, so it is less likely to be the cause of a sudden latency spike.

Practice this question →

36

MCQeasy

A small business hosts a web application on a single cloud server. The server has 2 vCPUs and 4 GB RAM. Recently, the application crashes when the number of concurrent users exceeds 50. The administrator checks the system logs and finds out-of-memory (OOM) errors. What is the best course of action to resolve this issue without redesigning the application?

A.Add a load balancer and another server

B.Reduce the application's memory footprint by code optimization

C.Increase the server's RAM to 8 GB

D.Enable swap space on the server

AnswerC

Increasing memory directly resolves OOM errors without application changes.

Why this answer

The best course of action is to increase the server's RAM to 8 GB (Option C). The OOM errors indicate that the current 4 GB RAM is insufficient for 50+ concurrent users. Increasing RAM directly addresses the memory shortage without requiring application changes or redesign.

Option A (load balancer and another server) adds complexity and cost, and may not resolve the memory issue on the single server if the application is not stateless. Option B (code optimization) is a redesign effort that may not be feasible as a quick fix. Option D (enabling swap space) can lead to severe performance degradation because swapping is much slower than RAM, and may still cause crashes under high load.

Practice this question →

37

MCQmedium

A cloud administrator is troubleshooting an application that is experiencing intermittent timeouts. The application runs on a cloud VM and connects to a cloud database. The administrator sees no errors in the application logs but notices high network latency during peak hours. Which of the following is the MOST likely cause?

A.Insufficient provisioned IOPS on the database

B.Incorrect database schema

C.SSL certificate mismatch between app and database

D.Missing route table entry for the database subnet

AnswerA

Low IOPS leads to queueing and increased latency under load.

Why this answer

Insufficient provisioned IOPS can cause queue buildup and increased latency during peak loads, leading to intermittent timeouts. Option B is incorrect because schema issues would typically cause query errors or failures, not just latency. Option C is incorrect because a missing route would cause complete connectivity failure, not intermittent timeouts.

Option D is incorrect because SSL misconfiguration would cause handshake failures and errors, not just latency.

Practice this question →

38

Multi-Selectmedium

A cloud architect is designing a highly available web application. Which THREE of the following components should be configured in at least two availability zones? (Choose THREE.)

Select 3 answers

A.Web server instances

B.Application load balancer

C.Database instance (primary and standby)

D.DNS service (e.g., Route 53)

E.Auto-scaling group

AnswersA, B, C

Instances should be deployed across AZs to handle requests if one AZ fails.

Why this answer

To achieve high availability across AZs, the load balancer, application servers, and database should be multi-AZ. Auto-scaling groups can launch instances across AZs, but they are not a component themselves; they are a management service. The DNS service is globally redundant by nature, not usually limited to AZs.

Practice this question →

39

MCQmedium

The exhibit shows the health check status for targets in an application load balancer's target group. The target group has a health check on port 80. An administrator notices that one target is unhealthy on port 80 but healthy on port 443. What is the most likely cause?

A.The web server on the target is not listening on port 443.

B.The security group for the target is blocking port 80 from the load balancer.

C.The load balancer is in a different VPC.

D.The health check path is incorrect.

AnswerB

A security group blocking port 80 would cause the health check on port 80 to fail, while port 443 remains healthy.

Why this answer

The target is healthy on port 443 but unhealthy on port 80, indicating that port 80 is not reachable from the load balancer. The most likely cause is that the security group for the target is blocking inbound traffic on port 80 from the load balancer. Option A is incorrect because the target is healthy on 443, so the web server is listening on that port, but it could still be listening on 80; the issue is connectivity.

Option C is incorrect because if the load balancer were in a different VPC, it wouldn't be able to communicate with any targets at all. Option D is incorrect because the health check path applies to both port 80 and 443 health checks if configured separately, but since only port 80 is failing and the path is the same, the path is not the issue.

Practice this question →

40

MCQhard

A cloud administrator sees the output above when troubleshooting a virtual machine that is unresponsive. The VM is critical and must be restored quickly. What should the administrator do first?

A.Resume the VM using the virsh resume command.

B.Restart the libvirtd service on the host.

C.Increase the memory allocation for the host to free resources.

D.Migrate the VM to another host in the cluster.

AnswerA

This directly addresses the paused state and will restore the VM to a running state.

Why this answer

The output from `virsh list --all` shows the VM is in a 'paused' state, which means it is still resident in memory but not executing. The fastest way to restore a paused VM is to resume it with `virsh resume <vm-name>`, which immediately continues CPU execution without requiring a reboot or migration. This directly addresses the unresponsive behavior while preserving the VM's current memory state.

Exam trap

The trap here is that candidates assume a paused VM requires a full restart or host-level intervention, but the CV0-004 exam expects you to recognize that `virsh resume` is the immediate, low-risk recovery action for a paused domain.

How to eliminate wrong answers

Option B is wrong because restarting the libvirtd service would disrupt all VMs on the host and is unnecessary when only a single VM is paused; the issue is at the VM level, not the hypervisor daemon. Option C is wrong because increasing host memory allocation does not affect a paused VM—pausing is triggered by storage I/O errors, disk full conditions, or host memory overcommitment, not by insufficient host memory. Option D is wrong because migrating a paused VM requires resuming it first or using `virsh migrate --live` which cannot work on a paused domain; migration adds unnecessary complexity and downtime when a simple resume command will restore service immediately.

Practice this question →

41

MCQeasy

A cloud administrator notices that a virtual machine is running but cannot be reached over the network. The administrator verifies that the VM is configured with the correct IP address and subnet mask. Which of the following is the MOST likely cause of this issue?

A.Cloud provider firewall blocking all traffic

B.Incorrect DNS server settings

C.Missing port forwarding rule

D.Misconfigured default gateway

AnswerD

Without a correct gateway, traffic cannot exit the subnet.

Why this answer

A misconfigured default gateway is the most likely cause when the IP address and subnet mask are correct but the VM cannot be reached over the network. The default gateway is responsible for routing traffic from the VM to other networks. If it is incorrect, the VM can communicate within its own subnet but not beyond, leading to unreachability.

Option A (firewall blocking traffic) is less likely because the administrator verified correct IP configuration, and a firewall issue would typically affect specific ports or protocols, not all connectivity. Option B (incorrect DNS) affects name resolution but not basic IP connectivity. Option C (missing port forwarding) is used for inbound NAT mappings and is not relevant to general network reachability.

Practice this question →

42

MCQhard

A cloud administrator notices that a virtual machine is consuming excessive CPU resources with no apparent workload. Which of the following should the administrator investigate FIRST to determine the cause?

A.A misconfigured load balancer sending traffic to the VM

B.CPU hotplug settings on the hypervisor

C.A runaway process inside the VM

D.Memory overcommitment ratio

AnswerC

A runaway process (e.g., infinite loop) can consume 100% CPU even with no intended workload.

Why this answer

A runaway process inside the VM is the most likely cause when a VM exhibits high CPU utilization without an apparent workload. This could be due to a background service, malware, or an application stuck in an infinite loop. Option A is incorrect because a misconfigured load balancer would direct traffic to the VM, which would result in network and CPU activity associated with processing that traffic, not idle high CPU.

Option B is incorrect; CPU hotplug settings affect the ability to add CPUs but do not themselves cause high CPU usage. Option D is incorrect; memory overcommitment affects memory availability, not CPU utilization.

Practice this question →

43

MCQhard

A cloud engineer is troubleshooting an issue where an application running in a container on a Kubernetes cluster is unable to resolve DNS names. The cluster uses CoreDNS. The engineer checks the CoreDNS pod logs and sees no errors. Which of the following should the engineer check next?

A.The Kubernetes DNS service IP address

B.The container's /etc/resolv.conf file

C.The cloud provider's DNS resolver settings

D.The network policy for the namespace

AnswerB

If this file does not point to CoreDNS, DNS resolution fails.

Why this answer

The container's /etc/resolv.conf file. In Kubernetes, pods use the DNS configuration specified in their /etc/resolv.conf, which should point to the CoreDNS service IP. If this file is misconfigured (e.g., due to a custom pod DNS policy or a problem with the kubelet), DNS resolution will fail.

The CoreDNS pod logs show no errors, indicating CoreDNS is running fine, so the issue is likely in how the pod is configured to contact CoreDNS. Option A (checking the Kubernetes DNS service IP) is not the next step because the DNS service IP is typically correct; the problem is whether the pod is using it. Option C (checking the cloud provider's DNS resolver settings) is for external DNS resolution, not for internal cluster DNS.

Option D (checking network policies) would cause traffic to be dropped entirely, not just DNS, and would likely show in logs or other symptoms.

Practice this question →

44

Multi-Selecthard

A cloud engineer is troubleshooting a performance issue where a web server cluster experiences high latency during peak hours. The cluster uses an auto-scaling group behind a load balancer. Which THREE steps should the engineer take to identify the root cause?

Select 3 answers

A.Monitor CPU and memory utilization on the web servers

B.Analyze web server access logs for slow requests

C.Check the load balancer's backend instance health status

D.Reduce the number of instances in the auto-scaling group

E.Review security group rules for the load balancer

AnswersA, B, C

High resource usage can cause slow responses.

Why this answer

High CPU or memory utilization on web servers directly indicates resource contention, which can cause increased request processing time and latency. Monitoring these metrics helps identify if the auto-scaling group is under-provisioned or if a specific instance is overloaded, guiding scaling policy adjustments.

Exam trap

The trap here is that candidates may think reducing instances (Option D) is a valid troubleshooting step, but it is a remediation action that can mask the root cause and potentially crash the application under load.

Practice this question →

45

MCQhard

A cloud administrator is troubleshooting why web-server-01 is not receiving traffic from an internet-facing load balancer. The load balancer is in the same VPC and subnet. According to the exhibit, what is the most likely reason?

A.The security group attached to the instance does not allow traffic from the load balancer

B.The instance is in a stopped state

C.The instance is not in the same VPC as the load balancer

D.The instance does not have a public IP address

AnswerA

The security group must allow inbound HTTP/HTTPS from the load balancer's security group or CIDR.

Why this answer

The exhibit likely shows the instance's security group 'web-sg' but no inbound rule allowing HTTP traffic from the load balancer. Since the load balancer is internet-facing and in the same VPC, it can route traffic to the instance via private IP. However, the instance's security group must explicitly allow inbound traffic from the load balancer (or its security group).

Without that rule, traffic is blocked. Therefore, the most likely reason is the security group not allowing traffic from the load balancer, making option A correct.

Practice this question →

46

MCQeasy

A cloud administrator is configuring a Linux VM as a router. The iptables rules are shown. The administrator can SSH into the VM from the network but cannot forward traffic between interfaces. What is the most likely cause?

A.The INPUT chain has a rule dropping invalid packets

B.The INPUT chain is missing a rule to allow forwarded traffic

C.The FORWARD chain's default policy is DROP and no rules allow forwarding

D.The NAT table is misconfigured

AnswerC

With default policy DROP and no FORWARD rules, all forwarded packets are dropped.

Why this answer

The FORWARD chain in iptables controls traffic that passes through the VM (i.e., traffic not destined for the VM itself). If its default policy is DROP and no explicit ACCEPT rules exist for forwarding, the kernel will drop all forwarded packets, preventing the VM from acting as a router. SSH access works because it uses the INPUT chain, which is separate from FORWARD.

Exam trap

The trap here is that candidates confuse the INPUT chain (for local traffic) with the FORWARD chain (for transit traffic), assuming that allowing SSH implies forwarding is also allowed, when in fact they are handled by completely separate chains.

How to eliminate wrong answers

Option A is wrong because the INPUT chain dropping invalid packets affects only traffic destined for the VM itself, not forwarded traffic; SSH connectivity proves INPUT is functional. Option B is wrong because forwarded traffic is governed by the FORWARD chain, not the INPUT chain; the INPUT chain has no role in forwarding decisions. Option D is wrong because the NAT table is used for source/destination NAT (e.g., masquerading) and does not control basic IP forwarding; even with correct NAT, packets will be dropped if the FORWARD chain blocks them.

Practice this question →

47

MCQmedium

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

A.Place all instances behind a single load balancer in one zone

B.Implement auto-scaling within the same availability zone

C.Use larger instance types to handle more load

D.Deploy application instances across three availability zones with a load balancer

AnswerD

Multi-AZ deployment ensures continued operation if one zone fails.

Why this answer

Deploying across multiple availability zones provides high availability. Option A is wrong because vertical scaling does not address zone failure. Option B is wrong because auto-scaling within a single zone does not help if the zone fails.

Option C is wrong because a single load balancer in one zone is a single point of failure.

Practice this question →

48

Multi-Selecthard

A company is migrating on-premises workloads to the cloud. They need to ensure high availability for a stateless web application across two availability zones. Which THREE components should be configured to meet this requirement?

Select 3 answers

A.An auto scaling group spanning both availability zones

B.A load balancer in front of the web tier

C.A read replica database in a different AZ

D.A single large compute instance to handle all traffic

E.Multiple subnets, each in a different availability zone

AnswersA, B, E

Correct; auto scaling maintains instance count across AZs.

Why this answer

An auto scaling group spanning both availability zones (Option A) ensures that the stateless web application can automatically replace failed instances and maintain the desired capacity across multiple AZs, which is essential for high availability. By distributing instances across AZs, the application can tolerate an entire AZ failure without losing all compute capacity.

Exam trap

The trap here is that candidates often confuse database-level high availability (like read replicas or multi-AZ database replication) with application-tier high availability, leading them to select a database option (C) when the question explicitly targets the stateless web tier.

Practice this question →

49

MCQhard

An administrator deployed a new web application using an auto-scaling group. Users report that the application becomes slow after a few hours. The administrator examines the scaling policy and notices that the CPU utilization threshold is set to 80% for scale-out and 20% for scale-in. What is the most likely issue?

A.The scale-in threshold is too low, causing instances to be terminated prematurely

B.The load balancer is misconfigured

C.The application has a memory leak

D.The scale-out threshold is too high, causing delayed scaling

AnswerD

At 80% CPU, scaling out only occurs after significant load, delaying additional capacity.

Why this answer

A scale-out threshold of 80% means that new instances are only added when CPU utilization reaches 80%, which can cause delays in scaling out, leading to performance degradation as the application becomes slow over time. Option A is incorrect because a low scale-in threshold of 20% would cause premature termination of instances, not slowness. Option B is incorrect because load balancer misconfiguration would typically cause immediate failures or uneven traffic distribution, not gradual slowdown.

Option C is incorrect because a memory leak would cause degradation over time, but the specific symptom of slowness after a few hours combined with the scaling policy thresholds points to the scaling configuration as the primary issue.

Practice this question →

50

MCQeasy

A company uses a multi-cloud strategy with workloads on AWS and Azure. An application running on an Amazon EC2 instance in a VPC uses an Azure SQL Database as its backend via a site-to-site VPN. Recently, users reported intermittent timeouts when accessing the application. The EC2 instance passes health checks, and the VPN tunnel status shows as 'UP' from both sides. The application logs show 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' Which of the following is the MOST likely cause of the issue?

A.The EC2 instance has exhausted its CPU credits, causing the application to become unresponsive.

B.The Azure SQL Database firewall does not allow traffic from the EC2 instance's IP address or the VPN gateway's IP.

C.The VPN tunnel is not properly routing traffic to Azure, causing intermittent connectivity.

D.The EC2 instance does not have sufficient IAM permissions to connect to Azure SQL Database.

AnswerB

Azure SQL has a firewall that must explicitly permit the source IP. The error 'login failed' often indicates the IP is blocked. The admin should add the VPN gateway's public IP to the allowed list.

Why this answer

The error message 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' indicates that the Azure SQL Database server rejected the connection attempt. Since the VPN tunnel is 'UP' and the EC2 instance passes health checks, the most likely cause is that the Azure SQL Database firewall rules do not include the source IP address of the traffic coming from the EC2 instance — either the EC2 instance's private IP (if traffic is routed through the VPN) or the public IP of the VPN gateway.

Azure SQL Database uses server-level firewall rules to allow client IP addresses, and without an explicit rule, all connections are blocked.

Exam trap

The trap here is that candidates see a VPN tunnel status of 'UP' and assume connectivity is fully functional, overlooking that Azure SQL Database has its own separate firewall layer that must explicitly permit the source IP address of the connecting client.

How to eliminate wrong answers

Option A is wrong because CPU credit exhaustion would cause performance degradation or throttling, not a specific login failure error from Azure SQL Database; the application logs clearly show a database authentication error, not a timeout or resource exhaustion. Option C is wrong because the VPN tunnel status is 'UP' from both sides, and the error is a login failure from the database server, not a routing or connectivity issue; if routing were broken, the application would likely see a network timeout or unreachable host error, not a specific SQL login failure. Option D is wrong because IAM permissions are an AWS construct used for AWS services (e.g., S3, DynamoDB) and have no bearing on authenticating to an Azure SQL Database; Azure SQL uses SQL authentication or Azure AD authentication, not AWS IAM.

Practice this question →

51

Multi-Selectmedium

A cloud administrator is troubleshooting a failed backup job that was supposed to back up a database to a cloud storage bucket. The job fails with an access denied error. Which two likely causes should the administrator investigate? (Choose two.)

Select 2 answers

A.The database is offline during backup

B.The IAM role assigned to the backup service lacks write permissions to the bucket

C.The backup schedule is misconfigured

D.The storage bucket has been deleted

E.The backup software version is incompatible

AnswersB, D

Insufficient permissions directly cause access denied errors.

Why this answer

Correct options are B and D. Option B is likely because the IAM role assigned to the backup service lacks write permissions to the bucket, resulting in an access denied error. Option D is likely because if the storage bucket has been deleted, the backup job cannot write to it, also producing an access denied error.

Option A is incorrect because an offline database would cause a connection error, not access denied. Option C is incorrect because a misconfigured backup schedule would prevent the job from running at the scheduled time, not cause an access denied error. Option E is incorrect because version incompatibility typically results in a software error, not an access denied error.

Practice this question →

52

Multi-Selectmedium

A cloud administrator is troubleshooting a connectivity issue between two VPCs in the same region. Which TWO actions should the administrator verify? (Choose two.)

Select 2 answers

A.VPC peering connection status

B.Route table entries

C.Security group rules

D.VPN tunnel configuration

E.Internet gateway attachment

AnswersA, B

The peering connection must be active.

Why this answer

The correct answers are A and B. The VPC peering connection must be in the 'active' state (A), and the route tables in both VPCs must have routes pointing to the peering connection (B). Security group rules (C) are not the primary check because security groups are stateful and allow return traffic by default; they can be configured to block traffic but are not the first thing to verify in this scenario.

VPN tunnel configuration (D) is a different connectivity method. Internet gateway attachment (E) is for internet access, not VPC peering.

Practice this question →

53

MCQeasy

A cloud user is unable to connect to a web server VM from the internet after a security group rule was modified. The VM is running and can be pinged from other VMs in the same subnet. What is the most likely cause?

A.The VM's local firewall is blocking the traffic.

B.The VM's routing table is missing a default gateway.

C.The inbound rule for HTTP/HTTPS was removed or misconfigured.

D.The VM's DNS settings are incorrect.

AnswerC

Security groups control inbound traffic; missing rule blocks internet access.

Why this answer

Modifying a security group rule likely removed or misconfigured the inbound HTTP/HTTPS rule, blocking internet traffic to the web server. The VM is accessible from other VMs in the same subnet (via private IP), indicating the OS and local services are running, but internet connectivity is controlled by the security group. Option A (local firewall) is unlikely because internal ping works.

Option B (missing default gateway) would affect all outbound and inbound traffic. Option D (DNS) affects name resolution, not direct IP connectivity.

Practice this question →

54

MCQeasy

A cloud administrator notices that a virtual machine is unresponsive. The VM is running on a hypervisor host that shows high CPU utilization. What should the administrator do first?

A.Reboot the hypervisor host

B.Increase the VM's vCPU count

C.Migrate the VM to another host

D.Check the VM console for OS-level issues

AnswerD

Checking the console allows direct assessment of the VM's OS state, such as a hung process or login prompt.

Why this answer

The first step in troubleshooting an unresponsive VM is to check the VM console for OS-level issues. This allows the administrator to see if the OS is hung, has a kernel panic, or is waiting for input. Option A is wrong because rebooting the hypervisor host would affect all VMs and is a drastic measure that should only be taken after other diagnostics.

Option B is wrong because increasing the VM's vCPU count does not address the root cause of unresponsiveness and could worsen resource contention on an already overloaded host. Option C is wrong because migrating the VM to another host is premature without first determining if the issue is OS-related; also, migration might not be possible if the VM is completely unresponsive.

Practice this question →

55

MCQmedium

During a disaster recovery test, a cloud administrator discovers that the standby database in a different region is not synchronized with the primary. The primary database uses asynchronous replication. What is the MOST likely reason for the sync failure?

A.License expiration on the standby database

B.Network latency causing replication lag

C.Firewall rules blocking port 3306 between regions

D.Incorrect replication configuration using a read replica instead of a standby

AnswerB

Asynchronous replication allows lag; high latency can increase lag, causing data not to be current.

Why this answer

Asynchronous replication does not guarantee immediate synchronization; network latency between regions can cause replication lag, meaning the standby may not have the latest data if the primary fails before sync completes. Option A is incorrect because license expiration would typically prevent the standby from starting or functioning, not cause lag. Option C is incorrect because a firewall blocking port 3306 would completely halt replication, not cause lag.

Option D is incorrect because while incorrect configuration could cause sync issues, the question specifies a standby database, and a read replica would not be used as a standby; the most likely reason in a DR test with async replication is network latency.

Practice this question →

56

Multi-Selecteasy

A cloud administrator is investigating why a virtual machine is running slowly. The administrator checks the hypervisor performance metrics. Which TWO of the following metrics indicate CPU contention? (Choose TWO.)

Select 2 answers

A.High CPU ready time

B.High disk queue depth

C.High CPU co-stop time

D.High memory ballooning

E.High CPU usage percentage

AnswersA, C

CPU ready time directly measures wait time due to contention.

Why this answer

CPU ready time (option A) and co-stop time (option C) are both indicators of CPU contention. Ready time is time a VM is ready to run but waiting for CPU; co-stop time is time a VM is stopped because another vCPU in the same VM is contending. Option E (High CPU usage percentage) is normal utilization, not contention.

Option B (High disk queue depth) is storage-related. Option D (High memory ballooning) is memory-related.

Practice this question →

57

MCQeasy

A cloud administrator is troubleshooting a performance issue where a web application experiences intermittent slowdowns. The application is deployed on a public cloud IaaS with auto-scaling. What should the administrator check first?

A.Verify load balancer configuration

B.Check CPU utilization of all instances

C.Analyze database query performance

D.Review network latency between tiers

AnswerA

Load balancer misconfiguration can cause intermittent failures.

Why this answer

A misconfigured load balancer can cause uneven traffic distribution, leading to intermittent slowdowns. Option B is wrong because CPU utilization spikes might be a symptom, not the root cause, and auto-scaling should handle it. Option C is wrong because database queries are a deeper layer to investigate after network and application tiers.

Option D is wrong because network latency is less likely to be intermittent.

Practice this question →

58

MCQmedium

Refer to the exhibit. A cloud engineer is troubleshooting network connectivity to a server with IP 10.0.0.5. The server is on the same subnet. Based on the iptables rules shown, what is the most likely cause of the connectivity failure?

A.The FORWARD chain policy drops all traffic

B.The OUTPUT chain rejects all traffic to the server

C.The DROP rule in INPUT has zero packet count, so it is not effective

D.The INPUT chain drops all traffic destined to the 10.0.0.0/8 network

AnswerD

Correct; the DROP rule in INPUT blocks traffic to 10.0.0.0/8.

Why this answer

The INPUT chain has a rule that drops all traffic destined to the 10.0.0.0/8 network, which includes the target server at 10.0.0.5. Since the server is on the same subnet, traffic to it must traverse the INPUT chain on the local system, and this DROP rule will match and discard packets before any other rule can accept them. The rule's position and destination match make it the most direct cause of the connectivity failure.

Exam trap

The trap here is that candidates often overlook the INPUT chain's destination match and assume the FORWARD chain is responsible for same-subnet traffic, or they misinterpret a zero packet count as an inactive rule, when in fact the rule is simply waiting for matching traffic.

How to eliminate wrong answers

Option A is wrong because the FORWARD chain only applies to traffic being routed through the system, not to traffic destined for the local system itself; since the server is on the same subnet, packets to 10.0.0.5 are not forwarded but processed locally via the INPUT chain. Option B is wrong because the OUTPUT chain controls traffic leaving the local system, not incoming traffic to the server; rejecting OUTPUT traffic would prevent the local system from sending packets, but the issue is about connectivity to the server, which is inbound. Option C is wrong because a DROP rule with a zero packet count simply means no packets have matched it yet; it is still present and effective in the ruleset, and once traffic matches, the count will increment—zero count does not imply the rule is inactive or ineffective.

Practice this question →

59

Multi-Selecthard

A cloud administrator is troubleshooting performance issues with a cloud object storage bucket that is used for storing large amounts of small files. The application reads and writes objects frequently. Which three actions could improve the performance? (Choose three.)

Select 3 answers

A.Use a multi-region bucket to reduce latency.

B.Increase the number of concurrent requests from the application.

C.Enable transfer acceleration using a CDN.

D.Enable versioning to avoid overwrites.

E.Use a prefix naming scheme that distributes objects across multiple partitions.

AnswersB, C, E

Increasing concurrency can improve throughput as long as the backend can handle it.

Why this answer

Options B, C, and E are correct. Option B increases throughput by allowing more parallel requests, which helps with small-file performance. Option C uses a CDN to accelerate data transfer, reducing latency.

Option E distributes objects across partitions using prefix naming, improving request rate. Option A is incorrect because multi-region buckets add replication latency. Option D is incorrect because versioning adds overhead for frequent writes.

Practice this question →

60

MCQeasy

A virtual machine in a cloud environment is experiencing high disk I/O latency. The administrator checks the performance metrics and sees that the disk queue length is consistently above 100. What is the best immediate action?

A.Attach an additional disk and stripe the data

B.Upgrade the VM's network bandwidth

C.Migrate the VM to a host with faster disks

D.Increase the VM's memory

AnswerA

Stripping adds parallelism, reducing queue depth and improving latency.

Why this answer

Attach an additional disk and stripe the data. A high disk queue length indicates that the disk is overwhelmed with I/O requests. Stripping data across multiple disks (e.g., RAID 0) distributes the I/O load, reducing queue length and latency.

Option B is wrong because network bandwidth does not affect disk I/O. Option C is wrong because migrating to a host with faster disks may help but is not the immediate action; adding disks is quicker and more direct. Option D is wrong because increasing memory does not directly improve disk I/O performance.

Practice this question →

61

MCQhard

A cloud administrator is troubleshooting a web application hosted on a cloud virtual machine (VM) that is experiencing intermittent high latency during peak traffic hours. The application is deployed on a single VM instance with 4 vCPUs and 8 GB RAM, running a Linux OS. The VM is connected to a virtual network with a public IP. The administrator has verified that the application code is optimized and there are no memory leaks. CPU utilization remains below 50% during peaks, but network outbound traffic shows periodic spikes up to 500 Mbps. The VM's network interface is configured with a 1 Gbps bandwidth cap. The administrator suspects that the issue is related to network throttling or packet loss. Which of the following actions should the administrator take to resolve the issue?

A.Increase the VM's vCPU count to 8 to improve processing capacity.

B.Upgrade the VM to a larger instance size with higher network bandwidth cap (e.g., 2 Gbps).

C.Configure the firewall to allow all traffic to reduce processing overhead.

D.Enable DDoS protection on the public IP to filter malicious traffic.

AnswerB

This directly addresses the network bottleneck causing latency during traffic spikes.

Why this answer

The VM's network bandwidth cap of 1 Gbps is being saturated during peak traffic (spikes up to 500 Mbps, but with overhead and burst behavior, the cap can cause throttling and packet loss). Upgrading to a larger instance size with a higher network bandwidth cap (e.g., 2 Gbps) directly addresses the bottleneck by providing more headroom for outbound traffic, reducing latency caused by queueing and drops. The administrator has already ruled out CPU and memory issues, so the network cap is the likely culprit.

Exam trap

The trap here is that candidates may assume CPU or memory is the bottleneck because latency is intermittent, but the question explicitly states CPU is below 50% and memory is fine, so the real issue is the network bandwidth cap, which is a common cloud-specific limitation tied to instance size.

How to eliminate wrong answers

Option A is wrong because increasing vCPUs does not increase network bandwidth capacity; the bottleneck is network throughput, not compute, and CPU utilization is already below 50%. Option C is wrong because configuring the firewall to allow all traffic would not reduce processing overhead in a meaningful way and could actually increase security risks; firewall processing overhead is negligible compared to the bandwidth cap limitation. Option D is wrong because DDoS protection is designed to filter malicious traffic, not to resolve throttling or packet loss caused by legitimate peak traffic exceeding the bandwidth cap.

Practice this question →

62

Multi-Selectmedium

A cloud administrator receives an alert that a VM's disk usage is at 95%. The VM is running a critical database. Which TWO actions should the administrator take to resolve the issue while minimizing downtime?

Select 2 answers

A.Increase the size of the existing disk

B.Shrink an existing partition to free space

C.Clear temporary files and logs

D.Restore the VM from a recent backup to a larger disk

E.Add a new disk and move data to it

AnswersA, C

Many cloud providers allow online disk resizing without rebooting.

Why this answer

Increasing the size of the existing disk (Option A) is correct because it allows the VM to gain additional storage capacity without requiring a reboot or migration, minimizing downtime. Modern hypervisors and cloud platforms support live resizing of virtual disks, and once the disk is expanded, the OS can extend the partition online using tools like `resize2fs` (Linux) or Disk Management (Windows). This directly addresses the 95% disk usage alert for the critical database with minimal service interruption.

Exam trap

The trap here is that candidates often choose Option E (add a new disk) thinking it is safer or more standard, but they overlook that expanding the existing disk is faster and causes less downtime for a critical database, and that adding a new disk introduces additional management overhead and potential service interruption.

Practice this question →

63

Matchingmedium

Match each disaster recovery term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Maximum time to restore services after outage

Maximum acceptable data loss in time

Automatic switch to standby system

Copy of data for restoration

Documented plan for disaster recovery

Why these pairings

Key disaster recovery terms: RTO focuses on downtime, RPO on data loss, failover is automatic, and cold site has minimal setup. Common confusions involve swapping RTO and RPO definitions or mischaracterizing failover as manual.

Practice this question →

64

MCQhard

A company is designing a multi-cloud disaster recovery solution. They need to ensure RPO of 15 minutes and RTO of 1 hour for critical workloads. Which of the following should be implemented?

A.Asynchronous replication to a secondary cloud with a 30-minute delay

B.Synchronous replication to a standby environment in another cloud provider

C.Pilot light environment that is started manually during a disaster

D.Daily backups to object storage in a different region

AnswerB

Correct; synchronous replication provides low RPO and fast failover.

Why this answer

Synchronous replication ensures that data is written to both the primary and standby environments simultaneously, guaranteeing zero data loss and meeting the 15-minute RPO. With a pre-configured standby environment in another cloud provider, failover can occur within minutes, satisfying the 1-hour RTO. This approach provides the lowest possible RPO and RTO for critical workloads.

Exam trap

CompTIA often tests the distinction between synchronous and asynchronous replication, where candidates mistakenly choose asynchronous replication for low RPO requirements, not realizing that asynchronous replication inherently introduces a delay equal to the replication interval.

How to eliminate wrong answers

Option A is wrong because asynchronous replication with a 30-minute delay cannot achieve a 15-minute RPO, as data loss could be up to 30 minutes. Option C is wrong because a pilot light environment that is started manually during a disaster typically has an RTO of hours, not 1 hour, due to the time required to provision and configure resources. Option D is wrong because daily backups to object storage cannot meet a 15-minute RPO, as data loss could be up to 24 hours, and recovery from backups often takes longer than 1 hour.

Practice this question →

65

MCQeasy

The exhibit shows the output of the df command and an application error. What is the most likely cause of the error?

A.The /dev/shm partition is full.

B.The /var partition is full.

C.The filesystem is corrupt.

D.The inode usage on the root filesystem is exhausted.

AnswerB

The root partition is at 95% usage, and since /var is under /, it is likely full.

Why this answer

The df output shows the /var partition is at 100% utilization, and the application error indicates it cannot write to disk, likely due to the /var partition being full. Option A is incorrect because /dev/shm is a tmpfs and not relevant to application writing to /var/log. Option C is incorrect because there is no evidence of filesystem corruption.

Option D is incorrect because the root filesystem still has space; the error indicates a space issue, not inode exhaustion.

Practice this question →

66

Multi-Selectmedium

A cloud engineer is troubleshooting a VM that is experiencing high latency. The VM is hosted on a hypervisor with other VMs. Which TWO metrics should the engineer review to identify if resource contention is occurring?

Select 2 answers

A.Memory ballooning

B.CPU ready time

C.Network packet drops

D.Swap usage

E.Disk queue length

AnswersA, B

Correct; memory ballooning indicates memory contention.

Why this answer

Memory ballooning (A) is a VMware mechanism where the hypervisor reclaims idle memory from a VM by inflating a balloon driver, forcing the VM to swap. High ballooning indicates memory overcommitment and contention, directly causing latency. CPU ready time (B) measures the time a VM is ready to run but waiting for a physical CPU core; elevated ready time signals CPU contention among VMs on the same hypervisor.

Exam trap

CompTIA often tests the distinction between guest-level metrics (swap usage, disk queue length) and hypervisor-level metrics (ballooning, ready time), and the trap here is that candidates confuse swap usage (guest OS paging) with memory ballooning (hypervisor reclaim), or assume network packet drops indicate VM contention rather than network issues.

Practice this question →

67

Multi-Selecteasy

A cloud administrator is troubleshooting a virtual machine that is experiencing high memory usage. The VM is running a web server. Which two metrics should the administrator monitor to determine if the VM needs additional memory? (Choose two.)

Select 2 answers

A.Swap usage

B.Disk I/O wait

C.Page fault rate

D.Available memory

E.CPU ready time

AnswersA, D

High swap usage indicates the OS is using disk as memory, a sign of insufficient physical memory.

Why this answer

Options A and D are correct. Available memory directly shows the amount of free RAM, and swap usage indicates that the OS is using disk as memory, which is a sign of insufficient physical memory. Disk I/O wait (B) is a disk performance metric, page fault rate (C) is a memory metric but is less direct than swap usage for determining if more memory is needed, and CPU ready time (E) is a CPU metric.

Practice this question →

68

MCQmedium

A cloud administrator is troubleshooting connectivity issues between two virtual networks in different regions. The virtual networks are peered, but instances cannot communicate. The administrator verifies that the peering status is 'Connected' and route tables appear correct. Which of the following should be checked next?

A.Network security group rules on the instances and subnets [CORRECT]

B.DNS resolution settings

C.Gateway subnet configuration

D.Service endpoint status

AnswerA

Correct; NSGs can block traffic even if VNet peering is established.

Why this answer

Even when virtual network peering status shows 'Connected' and route tables are correct, network security group rules can still block traffic. Network security groups act as a stateful firewall at the subnet or network interface level, and typically they deny all inbound traffic unless explicitly allowed. Since the administrator has already verified routing, the next logical step is to check network security group rules for any implicit deny or missing allow rules that could be dropping the inter-region traffic.

Exam trap

The trap here is that candidates assume a 'Connected' peering status guarantees traffic flow, but they overlook that network security group rules can silently drop traffic even when peering and routing are correctly configured.

How to eliminate wrong answers

Option B is wrong because DNS resolution settings affect name resolution, not IP-level connectivity; if instances cannot communicate via IP, DNS is irrelevant. Option C is wrong because gateway subnets are only used for VPN or ExpressRoute gateways, not for VNet peering; peering does not require a gateway. Option D is wrong because service endpoints are used to secure Azure service access (e.g., Storage, SQL) from a VNet, not for traffic between peered VNets; they do not control inter-VNet communication.

Practice this question →

69

MCQmedium

A cloud load balancer is not distributing traffic evenly to backend servers. All servers pass health checks. Which of the following is the most likely cause?

A.The health check interval is set too long.

B.One of the backend servers has reached its connection limit.

C.Session persistence is enabled and directing traffic to specific servers.

D.The health check path is incorrect.

AnswerC

Sticky sessions bind clients to a server, causing imbalance.

Why this answer

Session persistence (sticky sessions) is the most likely cause because it forces the load balancer to direct traffic from the same client to the same backend server, leading to uneven distribution. All servers passing health checks rules out health check issues (Option A and D). A server reaching its connection limit (Option B) would typically cause that server to stop accepting new connections, but health checks would likely fail, so it is less likely.

Practice this question →

70

MCQeasy

A cloud administrator runs a deployment script that creates multiple resources using Infrastructure as Code (IaC). The script fails with a "400 Bad Request" error when attempting to create a storage account. Which troubleshooting step should the administrator take first?

A.Check the network connectivity to the cloud API endpoint.

B.Increase the timeout value for the API call.

C.Review the error message details for a specific validation error.

D.Verify that the script has the correct region parameter.

AnswerC

The first step is to examine the error message to identify the invalid parameter.

Why this answer

A 400 error indicates a client error, so the first step is to examine the error details to understand what parameter is invalid. Option A is wrong because 400 is not a network error (would be 5xx). Option B is wrong but plausible; however, the error message would specify the exact issue.

Option D is wrong because timeouts result in different errors.

Practice this question →

71

MCQmedium

A cloud engineer is troubleshooting an issue where users cannot connect to a web application hosted on a cloud VM. The VM's security group allows HTTP (port 80) from 0.0.0.0/0, and the VM's OS firewall is disabled. The engineer can ping the VM's public IP from the internet. What is the most likely cause of the issue?

A.OS firewall is blocking port 80

B.Incorrect routing table on the VM

C.Security group rule is applied to the wrong subnet

D.Web server service is not running on the VM

AnswerD

If the web server is not running, it won't respond on port 80, even though the network allows it.

Why this answer

Since the OS firewall is disabled and the security group allows HTTP from 0.0.0.0/0, the only remaining layer that could block connectivity is the application itself. If the web server service (e.g., Apache, Nginx, IIS) is not running on the VM, it will not listen on TCP port 80, so HTTP requests will be refused even though network-level access is permitted. The ability to ping the VM confirms IP-level reachability, isolating the issue to the application layer.

Exam trap

The trap here is that candidates assume a ping success implies all services are reachable, but ICMP (ping) operates at the network layer (Layer 3) and does not test TCP port availability, so a running web server is required for HTTP connectivity.

How to eliminate wrong answers

Option A is wrong because the OS firewall is explicitly stated as disabled, so it cannot be blocking port 80. Option B is wrong because routing tables on the VM control outbound traffic, not inbound connections to the VM; inbound traffic is handled by the cloud provider's virtual network and security groups. Option C is wrong because security groups are stateful and applied at the VM network interface level, not to subnets; even if the rule were misapplied, the VM's security group explicitly allows HTTP from 0.0.0.0/0, so this is not the cause.

Practice this question →

72

Multi-Selecteasy

Which TWO are common causes of virtual machine performance degradation in a cloud environment?

Select 2 answers

A.Misconfigured security groups

B.Insufficient memory allocation

C.Network latency to storage

D.Incorrect DNS settings

E.High CPU ready time

AnswersB, E

Causes swapping and slow performance.

Why this answer

The correct answers are B and E. Insufficient memory allocation causes the VM to use swap space, significantly degrading performance. High CPU ready time indicates that the VM is waiting for CPU resources due to contention, another common cause of performance degradation.

Security groups (A) affect access control, not performance. Network latency to storage (C) can impact storage performance but is not as common as CPU/memory issues. Incorrect DNS settings (D) cause name resolution failures, not performance degradation.

Practice this question →

73

MCQeasy

A cloud engineer notices that an application is running slower than expected. Monitoring shows that the CPU utilization is consistently below 30%, but memory usage is at 95%. Which of the following is the most likely cause of the performance issue?

A.Insufficient disk space for application logs

B.Insufficient memory causing swapping to disk

C.Network bandwidth saturation

D.CPU contention due to overprovisioning

AnswerB

Correct; high memory usage leads to swapping, slowing performance.

Why this answer

When memory usage is at 95% and CPU utilization is low, the system is likely thrashing—the operating system is forced to page memory to disk (swap) to free RAM. Disk I/O is orders of magnitude slower than RAM, so even with idle CPU, the application stalls waiting for swap operations. This explains the performance degradation despite low CPU load.

Exam trap

The trap here is that candidates often associate performance issues solely with CPU or network bottlenecks, overlooking the severe impact of memory exhaustion and disk swapping, which can masquerade as a slow application with ample CPU headroom.

How to eliminate wrong answers

Option A is wrong because insufficient disk space for logs would cause write failures or application crashes, not a gradual slowdown with high memory and low CPU. Option C is wrong because network bandwidth saturation would manifest as high latency or packet loss, not as high memory usage with low CPU. Option D is wrong because CPU contention due to overprovisioning would show high CPU ready times or steal time, not consistently low CPU utilization; overprovisioning typically leads to CPU starvation, not memory exhaustion.

Practice this question →

74

Multi-Selectmedium

A cloud administrator is troubleshooting a virtual machine that is experiencing high CPU utilization during peak hours. The VM runs a web application and is hosted on a public cloud platform. Which TWO steps should the administrator take first to diagnose the issue?

Select 2 answers

A.Adjust the autoscaling policy to add more instances immediately.

B.Check for memory leaks in the application that could indirectly affect CPU.

C.Review the load balancer health check and traffic distribution settings for the backend pool.

D.Identify the process consuming the most CPU using the OS performance monitoring tools.

E.Immediately increase the number of vCPUs assigned to the VM.

AnswersC, D

Improper load balancer configuration can direct excessive traffic to this VM, causing high CPU.

Why this answer

Reviewing the load balancer health check and traffic distribution settings helps determine if the high CPU utilization is caused by uneven traffic distribution or unhealthy backend instances. If the load balancer is sending excessive traffic to a single VM due to misconfigured health checks or sticky sessions, the VM's CPU will spike. This is a first-step diagnostic action to rule out load balancing issues before investigating the VM itself.

Exam trap

The trap here is that candidates often jump to scaling actions (like adding vCPUs or instances) as a first step, but the exam emphasizes systematic troubleshooting—starting with load balancer and OS-level diagnostics before making changes.

Practice this question →

75

MCQhard

A cloud technician is troubleshooting connectivity from a VM with IP 10.0.0.1 to another VM at 10.0.1.10 in a different subnet. The ping output shows 'Destination Host Unreachable'. Which of the following is the most likely cause?

A.ARP resolution for the destination IP is failing

B.The network interface on the source VM is disabled

C.A firewall is blocking ICMP on the destination

D.The source's default gateway does not have a route to the destination network

AnswerD

The gateway (10.0.0.1) sends 'Destination Host Unreachable' when it has no route to the destination.

Why this answer

The 'Destination Host Unreachable' error indicates that the source VM (10.0.0.1) cannot find a path to the destination subnet (10.0.1.0/24). Since the VMs are in different subnets, the source must send traffic to its default gateway. If that gateway lacks a route to 10.0.1.0/24, it will drop the packet and send an ICMP Destination Unreachable message back, causing the observed error.

This is the most likely cause because the issue is at Layer 3 routing, not Layer 2 ARP or local interface problems.

Exam trap

CompTIA often tests the distinction between 'Destination Host Unreachable' (Layer 3 routing failure) and 'Request Timed Out' (Layer 4 or firewall blocking), tricking candidates into blaming ARP or firewalls when the real issue is a missing route on the gateway.

How to eliminate wrong answers

Option A is wrong because ARP resolution for the destination IP would only be attempted if the destination were on the same subnet; since 10.0.0.1 and 10.0.1.10 are in different subnets, the source VM will ARP for its default gateway, not the destination. Option B is wrong because if the network interface on the source VM were disabled, the ping would typically fail with a 'Network is unreachable' or 'No route to host' error, not 'Destination Host Unreachable', and the interface state would be visible in the VM's configuration. Option C is wrong because a firewall blocking ICMP on the destination would cause a timeout (no response) or 'Request timed out', not an immediate 'Destination Host Unreachable' message, which is generated by an intermediate router.

Practice this question →

Page 1 of 2 · 97 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Cloud Troubleshooting questions.

Start 20-question session