Cloud Service Troubleshooting and Optimization
Domain 4: Cloud Service Troubleshooting and Optimization
This domain tests diagnosis and cost/performance tuning. The exam expects a layered method: confirm scope, read metrics and logs, then test the network and application path before changing configuration.
Core rules
- ECS cannot reach the internet: check EIP or NAT gateway, route table, security group egress, network ACL, and DNS.
- ELB 502/504: check backend health check port and path, the security group between ELB and backend, application listen port, and timeout settings.
- RDS slow: inspect slow SQL, connection count, CPU/IOPS, and storage; scale read replicas or optimize indexes before resizing blindly.
- OBS 403: check IAM policy, bucket policy, ACL, and KMS permissions; 404 may be a wrong endpoint or region.
- Optimize with right-sizing, EVS IOPS tier, OBS lifecycle rules, CDN, Auto Scaling schedules, and subscription or spot pricing.
Worked example
Users report intermittent 502 errors from an ELB. CES shows backend CPU normal, but health check logs show timeouts every few minutes. The health check interval is 5 s with timeout 2 s, and the application GC pause exceeds 2 s. The fix is to raise the health check timeout and tune the JVM, not to add more ECS instances. Reasoning: 502 is generated by the load balancer when the backend fails the check or closes the connection; CPU is not the bottleneck.
Traps
- Opening a security group and assuming the network ACL is also open; ACLs are stateless.
- Resizing a database before checking slow queries and connection storms.
- Ignoring quota limits, which look like application failures during scale-out.