Exercise 1: Investigating an Unexpectedly High Bill — Possible Solution
====================================================================

The usual suspects to check first, per the chapter's own list:

1. Idle or oversized compute instances left running unnecessarily.
2. Unattached/orphaned storage volumes -- a terminated VM whose disk
   was never deleted.
3. Data transfer/egress costs -- especially data moving OUT of the
   provider or between regions.
4. Unused load balancers or NAT gateways still provisioned.
5. Forgotten dev/test environments never torn down after a project
   ended.

Reasoning for checking them in this order (or at least, checking ALL
of them before assuming something more exotic is happening):

These five are specifically singled out by the chapter as "the usual
suspects" precisely because they are the MOST COMMON real-world causes
of a cost increase -- checking them first has the best odds of finding
the actual cause quickly, before spending time on rarer or more
complex explanations. It's also notable that the customer reporting
"no obvious usage change" doesn't rule any of these out -- every item
on this list is specifically the kind of cost source that accrues
QUIETLY, without the customer necessarily doing anything they'd
consciously think of as "using more" -- an orphaned disk, an idle
load balancer, or a forgotten test environment all keep billing
without anyone actively interacting with them, which is exactly why a
customer can genuinely, honestly report no noticeable change in their
own behavior while costs still climb.

If none of these usual suspects explain the increase, the next step
per the chapter would be breaking down spend by service/tag to
identify the actual delta, then checking for pricing changes or newly
provisioned resources around when the increase started.

WHY THIS WORKS AS AN ANSWER
------------------------------
This reproduces the chapter's own list directly and explains WHY
checking it first is the right triage order -- both because it
statistically covers the most common cases, and because each item
specifically explains the "no obvious usage change" detail the
customer reported, since all five are cost sources that accumulate
passively rather than through active, noticeable customer behavior.