Troubleshooting

A mobile app backend runs behind a managed API gateway. During a marketing promotion, users report intermittent failures. The application logs show a burst of HTTP 429 responses returned by the gateway itself, while backend service CPU, memory, and latency metrics all remain well within normal ranges. What is the MOST likely root cause?

After deploying a new stateful firewall appliance in front of a two-subnet application tier, users report that some TCP connections to the web servers hang and eventually time out, while others succeed. Packet captures on the web servers show inbound SYN packets arriving and the servers sending SYN-ACK responses, but the clients never receive them. The firewall logs show the SYN packets passing through, but no matching entry for the return SYN-ACK traffic. What is the MOST likely root cause?

Users of a newly deployed application server are intermittently unable to authenticate against the corporate identity provider using OIDC tokens. The error logs on the application server show 'token used before issued' and 'token expired' messages even for freshly issued tokens. Other application servers behind the same load balancer authenticate successfully. Following a structured troubleshooting methodology, what should the administrator investigate FIRST on the failing server?

A cloud engineer notices that a containerized microservice on a Kubernetes cluster repeatedly restarts under load. Reviewing the pod, the engineer sees the container's last state shows 'Reason: OOMKilled' with 'Exit Code: 137'. CPU utilization remains low, and node-level memory has ample free capacity. What is the MOST likely cause of the restarts?

A single-page web application hosted on a static object storage bucket makes JavaScript fetch calls to a REST API on a different domain. Users report that the page loads correctly, but the data never appears. The browser developer console shows the API requests failing with a message indicating the response was blocked by the same-origin policy, while direct calls to the API using a command-line HTTP client return valid JSON with a 200 status. What is the MOST likely root cause?

A production application VM on a shared-tenancy public cloud instance is experiencing intermittent performance degradation. The guest OS reports low CPU utilization (around 30%), yet application response times are slow and requests occasionally time out. When you review the hypervisor-level metrics, you notice a consistently high 'CPU steal time' value. What is the MOST likely cause of the degradation?

A cloud engineer deploys a new version of a web application behind a load balancer. Immediately after deployment, users report intermittent HTTP 502 errors. The load balancer health checks show all backend instances as healthy, and CPU, memory, and network metrics on the instances are well within normal ranges. Application logs on the instances show requests being served successfully with 200 responses, but the load balancer access logs record a mix of 200 and 502 responses. Following a structured troubleshooting methodology, what is the MOST likely cause of the 502 errors?

After promoting a standby web server to a new public IP, an operations engineer updates the application's DNS A record and confirms the change is correct on the authoritative name server. However, roughly 40% of users continue to reach the old, now-unreachable IP address for over an hour, while the rest connect successfully. Using a structured troubleshooting methodology, what is the MOST likely root cause?

A cloud engineer is investigating a reporting application that runs on a VM using a general-purpose (burstable) SSD volume. The application performs well for the first several hours after a reboot, but by mid-afternoon users report the reports take much longer to generate. Metrics show that disk read/write throughput and IOPS drop sharply at the same time each day, while CPU and memory utilization remain normal. What is the MOST likely root cause?

A cloud engineer deploys an analytics application on a fleet of VMs that write intermediate processing results to a locally attached instance store volume. After a routine maintenance event forces several VMs to stop and start, users report that previously completed job results are missing, though the application itself restarts normally. Application and network logs show no errors. What is the MOST likely root cause of the missing data?

After a routine deployment, users intermittently receive HTTP 502 Bad Gateway errors from an application behind a cloud load balancer. The load balancer health checks pass most of the time, backend instances show low CPU and memory, and the application logs show no exceptions. However, the load balancer access logs reveal that failed requests correspond to entries where the backend response time exceeds the load balancer's configured idle/response timeout. Which action is the MOST appropriate next step to resolve the errors?

A microservice running on cloud VMs uses the instance metadata service to retrieve temporary IAM credentials on every outbound API call. During peak traffic, developers report intermittent authorization failures, and application logs show HTTP 429 responses when the service queries the metadata endpoint. IAM permissions and role trust policies are confirmed correct. What is the MOST likely root cause?

A cloud-hosted REST API intermittently returns HTTP 504 errors during peak traffic. The application servers show low CPU and memory usage, but the managed database shows a spike in 'active connections' that plateaus at exactly 100. Application logs show 'timeout acquiring connection from pool' entries that correlate with the 504 responses. What is the MOST likely root cause?

Users report that a cloud-hosted web application intermittently fails to load large report pages, while small pages and API calls always succeed. The application sits behind a Layer 7 load balancer. Backend server CPU, memory, and disk metrics are all normal, and health checks consistently pass. Access logs on the backend show that some requests complete while others are silently truncated mid-response. Following a structured troubleshooting methodology, which action should you take FIRST to isolate the root cause?

A cloud engineer receives reports that roughly one-third of users of a web application are experiencing slow page loads and occasional errors, while the rest of the users report no issues. The application runs behind a load balancer distributing traffic across three application servers, each with its own local in-memory session cache. Health checks on all three servers pass, and CPU and memory metrics look normal across the fleet. Following a structured troubleshooting methodology, what is the MOST likely cause the engineer should investigate first?

After deploying a new version of a web application behind a Layer 7 load balancer, all backend instances are marked unhealthy and the load balancer returns HTTP 502 to users. The instances are running and respond with HTTP 200 when tested directly via curl on their private IP at '/'. The load balancer health check is configured to probe '/healthz' on port 8080. A cloud engineer confirms the application listens on port 8080 but the new release moved the health endpoint to '/health'. Which action will most directly restore healthy status?

After migrating an application to a cloud VPC connected to the corporate data center over an IPSec VPN, users report that small requests (logins, health checks) succeed, but file uploads and large API responses hang and eventually time out. A packet capture shows large packets are being sent but never acknowledged, while small packets flow normally. Which is the MOST likely root cause?

A cloud engineer adds an inbound rule to a security group to allow HTTPS (443) from a partner's IP range. Testing from the partner network still fails to reach the application, while access from the corporate office (also allowed) works fine. The engineer confirms the rule shows correctly in the console and the application is listening on 443. Following a structured troubleshooting methodology, what is the MOST likely next step to identify the cause?

A microservice authenticates successfully to a third-party payment API using OAuth 2.0 client credentials, but every call to the refund endpoint returns HTTP 403 Forbidden. Calls to the read-only balance endpoint from the same service succeed. The access token is valid and not expired. What is the MOST likely cause?

An engineer runs a deployment pipeline that provisions ten additional compute instances of a specialized GPU instance type into an existing availability zone during a product launch. The API returns 'InsufficientInstanceCapacity' errors for six of the ten requests, while four succeed. IAM permissions, service quotas, and the launch template have all been verified as correct. Using a structured troubleshooting methodology, which action is MOST likely to resolve the failed launches?