CV0-004 Troubleshooting Practice Question
A cloud administrator is investigating a sudden increase in egress charges for an application running on multiple Linux VMs in a public cloud. The application makes frequent calls to a third-party REST API over the public internet. Which action should the administrator take FIRST to identify the source of the unexpected egress traffic?
⚠ Common exam trap
The trap here is assuming that billing or host-based tools can provide the granular network traffic details needed to pinpoint egress sources, when in fact flow logs are the correct first step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC flow logs and analyze the destination IP addresses and byte counts for outbound traffic.
VPC flow logs provide the necessary network-level visibility to identify the source of increased egress traffic. By analyzing flow logs, the administrator can see which instances are communicating with external IPs and the volume of data transferred. This targeted approach quickly narrows down the cause, whether it is a misconfigured application, a compromised instance, or a change in API usage patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a NAT gateway and route all outbound traffic through it to centralize logging.
Why it's wrong here
Deploying a NAT gateway changes the network architecture and does not immediately provide detailed per-instance traffic analysis. While NAT gateways can log some metrics, they do not replace the granular flow-level visibility needed to pinpoint the source. This action would incur additional cost and complexity without directly answering which instances are causing the egress spike.
- ✗
Install a host-based intrusion detection system (HIDS) on each VM to monitor outbound connections.
Why it's wrong here
A HIDS monitors system calls and file integrity, not network traffic volumes or destinations. It would not efficiently identify which outbound connections are generating high egress charges. While it can detect malicious activity, it is not the right tool for traffic analysis and would require significant management overhead across multiple VMs.
- ✓
Enable VPC flow logs and analyze the destination IP addresses and byte counts for outbound traffic.
Why this is correct
VPC flow logs capture metadata about IP traffic to and from network interfaces in a VPC, including source/destination IPs and bytes transferred. Filtering for outbound traffic to the third-party API's public IPs will reveal which instances are generating the most egress and confirm whether the increase is due to API calls or other traffic. This is the most direct first step to localize the source before deeper packet analysis.
- ✗
Review the cloud provider's billing dashboard for the previous month to compare costs.
Why it's wrong here
Billing dashboards show aggregate costs, not per-instance or per-destination traffic details. Comparing historical costs may confirm the increase but does not identify which VMs or which destinations are responsible. This approach delays diagnosis and does not provide the technical evidence needed to remediate the issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 834 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.