CV0-004 Operations and Support Practice Question
A cloud engineer needs to troubleshoot network connectivity issues between two subnets. Which feature can help capture and analyze network traffic metadata?
⚠ Common exam trap
Many exam-takers confuse observability services — candidates often pick CloudTrail because it sounds like it 'logs everything,' but CloudTrail logs API calls, not network flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Flow Logs
VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, packets, action) for traffic flowing through ENIs, subnets, or VPCs. This metadata is exactly what's needed to diagnose connectivity issues between subnets, since it shows whether traffic is being accepted or rejected by security groups and NACLs. It can be published to CloudWatch Logs or S3 for analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector performs vulnerability and network reachability assessments on EC2 instances; it does not capture or analyse traffic metadata. It would be correct for identifying software vulnerabilities and unintended network exposure, not for troubleshooting subnet connectivity.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configuration compliance against rules; it records configuration state changes, not network traffic metadata, so it cannot diagnose connectivity between subnets. It is tempting because it tracks infrastructure drift and compliance, which suits governance audits, but VPC Flow Logs captures the traffic records needed here.
- ✓
VPC Flow Logs
Why this is correct
VPC Flow Logs capture IP traffic metadata at the network interface level, recording source/destination IPs, ports, protocols, and packet accept/reject decisions without inspecting packet payloads. This satisfies the stem’s requirement to *analyse traffic metadata* between subnets, as the logs are published to Amazon CloudWatch Logs or S3 for querying with tools like Athena, enabling identification of blocked flows or asymmetric routing.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail records AWS API control-plane activity, not packet-level traffic metadata between subnets, so it cannot reveal connectivity faults. It is tempting because it audits who changed what, which suits security forensics or change tracking, but VPC Flow Logs is the feature that captures IP traffic metadata for troubleshooting.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.