Cloud+ · Domain 6 of 6

Cloud+ Domain 6: Troubleshooting

This domain covers systematically diagnosing and resolving cloud problems: connectivity and networking issues, performance and capacity issues, and security, deployment and automation failures.

Exam format
12%
Official domains
3
Assessment estimate
~11
Suggested study time estimate
10–15 hrs

About 9 min read Reviewed October 2026

Overview

Troubleshooting covers the systematic diagnosis and resolution of cloud problems, vendor-neutrally. It has three areas. Connectivity and networking covers diagnosing network and connectivity failures such as misconfigured security rules, routing, DNS and latency. Performance and capacity covers diagnosing slow performance, resource exhaustion, autoscaling not triggering and bottlenecks. Security, deployment and automation covers diagnosing access and permission failures, deployment errors, and failures in pipelines and automation.

At 12%, this domain is woven through every cloud role. The exam rewards a methodical troubleshooting approach: gathering information, forming and testing a hypothesis, isolating the cause through logs, metrics and configuration, and resolving it. Troubleshooting draws on the knowledge from every other domain, applied to find and fix the actual cause rather than guessing.

How it's tested

Cloud+ questions in this domain present a symptom or failure and ask for the cause or the next diagnostic step. Cloud+ questions are vendor-neutral and scenario-based, so translate any provider-specific knowledge into the generic concept and read the requirement before choosing.

  • Diagnose connectivity

    A network failure is described, and you identify the misconfiguration or diagnostic step.

  • Diagnose performance

    A slowness or capacity symptom is described, and you find the bottleneck or cause.

  • Diagnose security or automation

    A permission, deployment or pipeline failure is described, and you identify the cause.

Reasoning it through

Two cloud instances cannot communicate, although they are in the same network and the application is running. The instinct to restart the application does not address a network block. Checking the security rules and network ACLs first often reveals that a rule is not allowing the traffic, which is the methodical first step the exam expects for a connectivity failure, isolating the cause before changing anything.

Domains 3

Official domains from the CompTIA outline, in outline order.

6.1 Troubleshoot connectivity and networking issuesDiagnosing security rules, routing, DNS and latency problems.
What it means
This covers diagnosing connectivity and networking failures: misconfigured security groups and network ACLs, routing and gateway problems, DNS resolution failures, latency and packet loss, and VPN or peering issues, using a methodical approach.
What to understand
Connectivity failures often come from security rules or ACLs blocking traffic, routing or gateway misconfiguration, or DNS problems. The methodical approach checks configuration and uses tools to trace the path and isolate where traffic stops. Confirming the cause with evidence precedes changing anything.
How it shows up
A connectivity failure is described, and you must identify the likely cause or the next diagnostic step.
Common confusion
Confusing a security-rule block with a routing problem; both stop traffic, but the fix differs, so the cause must be isolated.
6.2 Troubleshoot performance and capacity issuesDiagnosing slowness, resource exhaustion and autoscaling failures.
What it means
This covers diagnosing performance and capacity problems: slow response times, resource exhaustion such as CPU, memory or storage limits, autoscaling not triggering, database or network bottlenecks, and undersized resources, using metrics to find the constraint.
What to understand
Performance problems trace to a specific bottleneck, revealed by metrics: a saturated resource, a misconfigured autoscaler, or a slow dependency. The methodical approach measures to find the constraint rather than scaling everything. Autoscaling failures often come from misconfigured thresholds or limits.
How it shows up
A performance or capacity symptom is described, and you must identify the bottleneck or cause.
Common confusion
Confusing a capacity limit with a performance tuning issue; a hit quota or limit differs from an inefficient configuration.
6.3 Troubleshoot security, deployment, and automation issuesDiagnosing permission failures, deployment errors and pipeline failures.
What it means
This covers diagnosing security and access problems such as permission and authentication failures, deployment errors such as misconfiguration or failed provisioning, and failures in CI/CD pipelines and automation such as failed stages, broken infrastructure-as-code runs or configuration drift.
What to understand
Access failures often come from missing or over-scoped permissions or authentication problems. Deployment errors come from misconfiguration or unmet dependencies. Pipeline and automation failures come from failed stages, errors in infrastructure-as-code, or drift between declared and actual state. Logs and error messages isolate the cause.
How it shows up
A security, deployment or automation failure is described, and you must identify the cause or diagnostic step.
Common confusion
Confusing an authentication failure with an authorization failure; one means the identity is not verified, the other that it lacks permission.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Methodical troubleshooting

    Gather, hypothesize, test, isolate, resolve.

    Remember
    Confirm the cause before acting.
    Tested as
    All troubleshooting questions.
    Trap
    Jumping to a fix.

  • Security rule blocks

    Security groups or ACLs blocking traffic.

    Remember
    A frequent connectivity cause.
    Tested as
    Connectivity questions.
    Trap
    Overlooking rule configuration.

  • Routing and DNS issues

    Misrouted traffic or failed name resolution.

    Remember
    Common connectivity causes.
    Tested as
    Connectivity questions.
    Trap
    Assuming the app is at fault.

  • Resource exhaustion

    A saturated CPU, memory or storage limit.

    Remember
    Metrics reveal the saturated resource.
    Tested as
    Performance questions.
    Trap
    Scaling the wrong resource.

  • Autoscaling failures

    Thresholds or limits preventing scaling.

    Remember
    Check the autoscaler configuration.
    Tested as
    Performance questions.
    Trap
    Assuming autoscaling always works.

  • Bottleneck isolation

    Measuring to find the real constraint.

    Remember
    Fix the measured bottleneck.
    Tested as
    Performance questions.
    Trap
    Broad changes that miss the cause.

  • Permission failures

    Missing or over-scoped access.

    Remember
    Check IAM and roles.
    Tested as
    Security troubleshooting questions.
    Trap
    Guessing at access issues.

  • Authentication vs. authorization failure

    Identity not verified versus lacking permission.

    Remember
    Distinguish the two in diagnosis.
    Tested as
    Security troubleshooting questions.
    Trap
    Confusing the two.

  • Deployment errors

    Misconfiguration or unmet dependencies.

    Remember
    Read error messages and logs.
    Tested as
    Deployment troubleshooting questions.
    Trap
    Retrying without diagnosing.

  • Pipeline and IaC failures

    Failed stages, IaC errors or drift.

    Remember
    Logs and state reveal the cause.
    Tested as
    Automation questions.
    Trap
    Ignoring configuration drift.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Security-rule block vs. routing issue

ConceptMeaningKey differenceCommon trap
Security-rule block A rule denies the traffic Fix the rule Confusing with routing
Routing issue Traffic takes the wrong path Fix the route or gateway Confusing with a rule

Capacity limit vs. performance tuning

ConceptMeaningKey differenceCommon trap
Capacity limit A quota or resource exhausted Raise capacity or quota Confusing with tuning
Performance tuning Inefficient configuration Optimize or cache Confusing with a limit

Authentication vs. authorization failure

ConceptMeaningKey differenceCommon trap
Authentication failure Identity not verified Fix credentials or MFA Confusing with authorization
Authorization failure Lacks permission Grant the needed role Confusing with authentication

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Restart before diagnosing

    What candidates pick
    Restart the application when two instances cannot communicate on the network.
    Why it looks right
    A restart often helps.
    Why it's wrong
    A connectivity failure is usually a network configuration issue; check security rules, ACLs and routing before restarting.

    Clue to watch for The problem is instances not communicating on the network.

  2. Scale everything

    What candidates pick
    Scale up all resources to fix a slow application.
    Why it looks right
    More capacity seems to help.
    Why it's wrong
    Metrics should isolate the specific bottleneck; scale or tune the constrained resource, not everything.

    Clue to watch for One resource or dependency is the actual constraint.

  3. Auth failure is always login

    What candidates pick
    Treat every access failure as an authentication problem.
    Why it looks right
    Both block access.
    Why it's wrong
    An authentication failure means the identity is not verified; an authorization failure means it lacks permission, and the fix differs.

    Clue to watch for The user is logged in but cannot access a resource.

  4. Retry a failed deployment

    What candidates pick
    Simply retry a failed deployment without reading the error.
    Why it looks right
    It might work next time.
    Why it's wrong
    Deployment errors have a cause, such as misconfiguration or an unmet dependency, revealed by the error message and logs.

    Clue to watch for A deployment fails with an error message.

  5. Ignore configuration drift

    What candidates pick
    Assume infrastructure matches its code when a pipeline behaves unexpectedly.
    Why it looks right
    The code defines the state.
    Why it's wrong
    Configuration drift between declared and actual state can cause failures; compare and reconcile them.

    Clue to watch for Actual infrastructure may differ from its declared state.

Answer framework

For any Domain 6 scenario, use these steps to find the vendor-neutral answer Cloud+ expects.

  1. Apply a methodical approach: gather information, form a hypothesis, test it, isolate the cause, then resolve, rather than guessing.
  2. For connectivity, check security rules, ACLs, routing and DNS, and trace where traffic stops before changing anything.
  3. For performance, use metrics to isolate the bottleneck or capacity limit, and address the measured constraint rather than scaling broadly.
  4. For security, deployment and automation, read logs and error messages to distinguish authentication from authorization failures, find deployment misconfigurations, and detect pipeline errors or drift.
  5. Confirm the cause with evidence, apply the fix, and verify the resolution. Where several options could fit, choose the generic concept the requirements make defensible rather than a provider-specific product name.

Practice question

Two virtual machines in the same cloud virtual network cannot communicate with each other, even though both are running and the application is healthy. What is the BEST first troubleshooting step?

Want more like this? The Cloud+ practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain as applying a method, not memorizing fixes. Learn the systematic troubleshooting flow, gather, hypothesize, test, isolate, resolve, and practice applying it so you never jump to a fix without evidence. The exam rewards the correct next diagnostic step as much as the final cause.

Because troubleshooting integrates every other domain, your work on architecture, deployment, operations, security and DevOps directly supports it. Focus on the common causes: security rules and ACLs and DNS for connectivity, resource exhaustion and misconfigured autoscalers for performance, and permission failures, deployment misconfiguration and pipeline errors and drift for security and automation. Keep the authentication-versus-authorization and capacity-versus-tuning distinctions clear.

This is the final domain, so finish with full practice tests spanning all six, and because the exam is 90 questions in 90 minutes, practice pacing. Treat every question as isolating the real cause from the evidence given. Because Cloud+ is vendor-neutral and partly hands-on, map each provider product you know to its generic concept and practice the tasks on a real cloud, and review missed practice questions by domain to find weak spots.

FAQ

How much of Cloud+ is Domain 6?

Troubleshooting is 12% of the exam, and it integrates knowledge from every other domain.

What is the best general approach to troubleshooting on the exam?

A methodical one: gather information, form and test a hypothesis, isolate the cause using logs, metrics and configuration, then apply and verify the fix, rather than guessing or jumping to a solution.

What usually causes two instances in the same network not to communicate?

Most often a network configuration issue such as a security group or network ACL rule not allowing the traffic, or a routing problem, which should be checked before restarting or rebuilding anything.

How do I troubleshoot slow performance?

Use metrics to isolate the specific bottleneck, such as a saturated CPU, memory or storage, a slow dependency, or a misconfigured autoscaler, and address the measured constraint rather than scaling everything.

What is the difference between an authentication and an authorization failure?

An authentication failure means the identity could not be verified, such as bad credentials. An authorization failure means the verified identity lacks permission for the action. The fixes differ.

What is configuration drift?

When the actual state of infrastructure diverges from its declared infrastructure-as-code definition, which can cause unexpected failures and is resolved by comparing and reconciling the two.

How does Domain 6 connect to the rest of the exam?

Troubleshooting applies the knowledge of all the other domains, architecture, deployment, operations, security and DevOps, to diagnose and resolve real problems using evidence.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

You have covered methodical diagnosis of connectivity, performance, security, deployment and automation issues. Test whether you can isolate the real cause under exam conditions.

Take the Cloud+ practice test Check your Cloud+ readiness

Keep going