CV0-004 Operations and Support Practice Question
A cloud administrator is troubleshooting network connectivity issues between two VPCs in AWS. The administrator wants to examine traffic flow logs to identify dropped packets. Which AWS feature provides detailed network traffic logs for VPCs?
⚠ Common exam trap
CV0-004 often tests the confusion between CloudTrail (API audit) and VPC Flow Logs (network traffic) — candidates pick CloudTrail because it 'logs everything,' but it does not capture packet-level flow data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Flow Logs
VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, action) for network interfaces in a VPC, and can be published to CloudWatch Logs or S3. They are the correct tool for diagnosing dropped packets and connectivity issues between VPCs, showing ACCEPT and REJECT records. CloudTrail, X-Ray, and CloudWatch Logs serve different observability purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS X-Ray
Why it's wrong here
X-Ray traces request paths through distributed applications, mapping latency across services and downstream calls. It is the right choice for diagnosing slow or failing microservice requests, but it captures no VPC-level packet metadata such as ENI, port or REJECT entries, so it cannot identify dropped packets between VPCs.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail records AWS API activity — who called which action and when — not packet-level metadata such as source/destination IP, port, protocol or ACCEPT/REJECT verdicts. It is the right tool for auditing configuration changes, for example who deleted a route table entry, rather than diagnosing dropped traffic between VPCs.
- ✓
VPC Flow Logs
Why this is correct
VPC Flow Logs capture IP traffic metadata for elastic network interfaces, subnets and VPC peering connections, recording accepted and rejected packets with source, destination and port details. This directly satisfies the administrator's requirement to examine traffic flow records and identify where packets are being dropped between the two VPCs.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs is a general log storage and query service; VPC Flow Logs must first be published to it, and it holds no native network metadata of its own. It is the correct destination when you already have flow logs or application logs to search, not the feature that captures traffic records.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 834 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.