A customer reports your web app is 'down,' but your monitoring shows all servers healthy and other users are unaffected. What is the most effective first troubleshooting step?
- A. Immediately restart the production application servers
- B. Ask the customer for specifics: exact error, URL, browser, and when it started, ideally with a screenshot ✓
- C. Tell the customer it's working fine on your end and close the ticket
- D. Escalate directly to the senior backend engineering team
Correct answer: B. When symptoms aren't reproducible system-wide, gathering concrete reproduction details from the reporter is the fastest path to isolating whether it's environmental, user-specific, or a real bug.
You need to check whether a web server is returning the correct HTTP status and headers for a given URL from the command line. Which command is most appropriate?
- A. ping example.com/api/health
- B. curl -I https://example.com/api/health ✓
- C. traceroute example.com
- D. netstat -an | grep 443
Correct answer: B. curl -I sends a HEAD request and prints the response status line and headers, which is exactly what you need to inspect an endpoint's HTTP response.
A user gets a '403 Forbidden' error on a page that other users can access normally. Which cause is most consistent with this symptom?
- A. The server is completely down and unreachable
- B. The user's account lacks the permission or role required for that resource ✓
- C. There is a DNS resolution failure for the domain
- D. The database has run out of disk space
Correct answer: B. A 403 means the server understood the request but refuses to authorize it, which for a single affected user typically points to missing permissions rather than an outage or infrastructure failure.
While tailing application logs to diagnose an intermittent error, which command lets you watch new log lines appear in real time and filter for the word 'ERROR'?
- A. cat app.log | grep ERROR
- B. grep ERROR app.log | wc -l
- C. tail -f app.log | grep ERROR ✓
- D. head -n 100 app.log | grep ERROR
Correct answer: C. tail -f streams new lines as they are written, and piping to grep ERROR filters that live stream to only matching lines.
A customer says their API requests started failing with '401 Unauthorized' this morning, though nothing changed on their side. What is the most likely explanation to check first?
- A. The API endpoint URL was permanently deleted
- B. Their API key or access token expired or was rotated/revoked ✓
- C. The customer's monitor has a rendering glitch
- D. Their local machine ran out of RAM
Correct answer: B. A 401 indicates missing or invalid authentication credentials, and an expired or rotated token is the most common reason previously working requests suddenly fail with 401.
You suspect a slow page load is caused by one specific backend call. Which browser tool gives you the clearest per-request timing breakdown?
- A. The browser's Console tab
- B. The browser's Network tab (DevTools) ✓
- C. The browser's bookmarks manager
- D. The operating system's task manager
Correct answer: B. The Network tab in DevTools lists each request with its status, size, and timing waterfall, letting you pinpoint which call is slow.
A customer reports data they entered 'disappeared,' but you can see the record exists in the database with correct values. What is the most likely front-end explanation to investigate?
- A. The database dropped the table and recreated it
- B. The user is viewing a stale cached page or is logged into a different account/environment ✓
- C. The server's CPU is overheating
- D. The record was encrypted and cannot be shown
Correct answer: B. When the backend clearly has the data but the user can't see it, caching, session/account mismatch, or wrong environment are the usual causes to check first.
When writing a public reply to a frustrated customer whose issue you've confirmed is a real bug now scheduled for a fix, which response is best?
- A. 'This isn't really a bug, you're just using it wrong.'
- B. Acknowledge the impact, confirm it's a known bug, give a realistic ETA or workaround, and offer to follow up ✓
- C. Promise it will be fixed within the hour to calm them down
- D. Copy and paste a generic canned apology with no specifics
Correct answer: B. Good support acknowledges the customer's experience, sets honest expectations, and provides a concrete path forward, which builds trust without overpromising.
A SQL query a customer relies on is returning zero rows unexpectedly. You want to verify their data exists without risking any changes. Which query is safest to run first?
- A. DELETE FROM orders WHERE customer_id = 42
- B. UPDATE orders SET status = 'active' WHERE customer_id = 42
- C. SELECT COUNT(*) FROM orders WHERE customer_id = 42 ✓
- D. TRUNCATE TABLE orders
Correct answer: C. A SELECT COUNT(*) is read-only and safely confirms whether matching rows exist, whereas DELETE, UPDATE, and TRUNCATE all modify or destroy data.
A customer's requests are intermittently failing and you see '429 Too Many Requests' in their logs. What does this indicate?
- A. The server crashed and needs a reboot
- B. They are hitting a rate limit and should throttle or batch their requests ✓
- C. Their SSL certificate is invalid
- D. The request body was malformed
Correct answer: B. HTTP 429 signals the client has sent too many requests in a given window, so the fix is to respect the rate limit by slowing down or spacing out requests.
A single user reports a public website is very slow, but all other users and your monitoring show normal performance. What is the most sensible first step?
- A. Restart the production web server
- B. Investigate the user's local network, browser, and device ✓
- C. Redeploy the application
- D. Immediately escalate to the development team
Correct answer: B. When only one user is affected while metrics are normal, the issue most likely lies on the client side, so start there.
An HTTP 502 Bad Gateway error from a reverse proxy typically means what?
- A. DNS resolution failed
- B. The upstream server returned an invalid response to the proxy ✓
- C. The client's request timed out
- D. The SSL certificate expired
Correct answer: B. 502 means a gateway or proxy received an invalid or unexpected response from the upstream server.
Which command quickly identifies the process listening on TCP port 8080?
- A. ping 8080
- B. lsof -i :8080 ✓
- C. cat /etc/hosts
- D. df -h
Correct answer: B. lsof -i :8080 lists the process bound to that port; ss -ltnp works similarly.
A customer's API request returns HTTP 401. What does this indicate?
- A. The rate limit was exceeded
- B. Authentication failed or credentials are missing/invalid ✓
- C. The endpoint does not exist
- D. The server crashed
Correct answer: B. 401 Unauthorized means valid authentication credentials are missing or incorrect.
Which command finds all lines containing the word ERROR in a large application log file?
- A. grep ERROR app.log ✓
- B. chmod ERROR app.log
- C. cat ERROR app.log
- D. find ERROR app.log
Correct answer: A. grep searches a file for lines matching a pattern, here ERROR.
What does the command 'tail -f application.log' do?
- A. Shows the last lines and streams new lines as they are appended ✓
- B. Deletes the last lines of the file
- C. Sorts the file alphabetically
- D. Counts the number of lines
Correct answer: A. tail -f follows the file, printing new content in real time as it is written.
A server's application is failing due to a full disk. Which command best helps locate what is consuming space in the current directory?
- A. du -sh * ✓
- B. ps aux
- C. top
- D. whoami
Correct answer: A. du -sh * summarizes the size of each item in the current directory to find large consumers.
An API repeatedly returns HTTP 429. What is happening?
- A. Access is forbidden
- B. The client is being rate limited for too many requests ✓
- C. The gateway timed out
- D. The credentials are invalid
Correct answer: B. 429 Too Many Requests means the client has exceeded the allowed request rate.
A user can reach a site by typing its IP address but not by its domain name. What is the most likely cause?
- A. An SSL certificate misconfiguration
- B. A DNS resolution problem ✓
- C. A firewall blocking port 443
- D. The database being down
Correct answer: B. Working by IP but not by name points to a DNS resolution failure for that domain.
What is the key difference between HTTP 403 and HTTP 404?
- A. 403 is a server error; 404 is a client error
- B. 403 means access is forbidden; 404 means the resource was not found ✓
- C. They are functionally identical
- D. 403 is a redirect; 404 requires authentication
Correct answer: B. 403 Forbidden denies access to an existing resource, while 404 means the resource does not exist.
A user can successfully ping a website's IP address but cannot open the site by its domain name. What is the most likely cause?
- A. The web server is down
- B. A DNS resolution problem ✓
- C. An expired SSL certificate
- D. A firewall blocking ICMP
Correct answer: B. Reaching the IP but not the name points to name resolution (DNS) failing on the client's side.
A reverse proxy returns HTTP 502 Bad Gateway to users. What does this most directly indicate?
- A. The client sent a malformed request
- B. The proxy received an invalid response from the upstream backend ✓
- C. The requested URL does not exist
- D. The user is rate limited
Correct answer: B. 502 means the gateway/proxy got an invalid or no response from the upstream server it forwarded to.
You need to find which process is listening on port 8080 on a Linux host. Which command is appropriate?
- A. ss -tlnp | grep 8080 ✓
- B. df -h /8080
- C. chmod 8080 file
- D. ping localhost:8080
Correct answer: A. ss -tlnp lists listening TCP sockets with the owning process, filterable by port.
An application log repeatedly shows 'Connection refused' when trying to reach a database on port 5432. What is the most probable cause?
- A. The database credentials are wrong
- B. No process is listening on that port / the service is down ✓
- C. The disk is full
- D. The SSL certificate expired
Correct answer: B. 'Connection refused' means the target port had no listener, typically because the service is stopped or bound elsewhere.
Which grep invocation searches a log file for the word 'error' regardless of letter case?
- A. grep -v error app.log
- B. grep -c error app.log
- C. grep -i error app.log ✓
- D. grep -l error app.log
Correct answer: C. The -i flag makes the pattern match case-insensitively (Error, ERROR, error).
A customer suddenly starts receiving HTTP 429 responses from an API. What is happening?
- A. Their authentication token expired
- B. They are being rate limited for too many requests ✓
- C. The endpoint was moved permanently
- D. The server is under maintenance
Correct answer: B. 429 Too Many Requests indicates the client exceeded the API's allowed request rate.
Only one customer reports a web app is slow while all others are fine and monitoring is green. What is the best FIRST diagnostic step?
- A. Restart the production web server
- B. Reproduce from a different network/location and run traceroute from the user ✓
- C. Roll back the last deployment
- D. Increase server RAM
Correct answer: B. When the issue is isolated to one user, you first confirm whether the problem is local to their network/path before touching production.
A browser shows NET::ERR_CERT_DATE_INVALID when loading a site over HTTPS. What is the most likely root cause?
- A. The DNS record was deleted
- B. The TLS/SSL certificate has expired or is not yet valid ✓
- C. The server ran out of disk space
- D. The user's password is wrong
Correct answer: B. This error means the certificate's validity dates don't cover the current time, usually an expired cert.
Which SQL query returns the total number of rows in a table named orders?
- A. SELECT COUNT(*) FROM orders; ✓
- B. SELECT * FROM orders;
- C. SELECT SUM(orders);
- D. COUNT ROWS orders;
Correct answer: A. COUNT(*) returns the number of rows in the result set of the query.
When should a Support Engineer typically escalate a ticket to L2/engineering rather than continue troubleshooting?
- A. As soon as any customer complains
- B. When the issue requires code changes or access beyond the support tier's scope ✓
- C. Whenever the ticket is more than one hour old
- D. Only after the customer asks to escalate
Correct answer: B. Escalation is warranted when resolution needs privileges, code changes, or expertise outside the current tier's remit.