A symptom identifies a failed outcome, not its cause. A timeout can come from a blocked network path, slow code, connection exhaustion, or repeated retries. A denied request can come from a missing allow, an explicit deny, a boundary, or the wrong identity. Start with the exact request, time window, account, Region, and resource.
Change one justified control at a time and read the evidence back. An application-to-database path needs routes, security rules, a listener, credentials, and a healthy database. Opening every port may hide one problem while creating another. The exercises ask you to make a narrow repair or choose the next diagnostic step. A fix is complete when the original user action succeeds and the required protections still hold, not merely when one error message disappears.