Exercise 1: A 40% Bill Jump With Zero Usage Change — What to Rule Out First — Possible Solution ==================================================================== The category to rule out first: a PRICING/RATE CHANGE -- specifically, whether a reserved instance or committed-use discount agreement recently expired, causing that usage to revert to on-demand rates. Why this doesn't require any resource-level investigation to check: Per the chapter, this scenario "produces exactly the same-shaped cost jump as a 'usual suspect' resource problem, but with literally zero change in actual resource usage." The exercise's own detail -- "zero change in actual application usage or traffic" -- is precisely the signature this category produces, since NOTHING about the resources themselves changed; only the PRICE being charged for the exact same usage changed. Checking this specifically doesn't require examining individual resources, utilization metrics, or tags at all -- it only requires checking the STATUS of any reserved instance or committed-use agreements (whether they're still active, and when they expire or expired) against the billing period where the increase started. This is a single, direct lookup, not an investigation across potentially many resources. Why checking this FIRST specifically matters: per the chapter's own tip-box, if this is skipped, an investigator could spend considerable time working through the resource-level "usual suspects" (idle compute, orphaned storage, egress, forgotten environments) looking for something that changed -- and find NOTHING, because nothing actually did change at the resource level. The entire resource-level investigation would be looking in the wrong place for an increase that was actually a pure pricing change, wasting real time before eventually (or never) arriving at the correct explanation. WHY THIS WORKS AS AN ANSWER ------------------------------ This directly connects the exercise's own "zero usage change" detail to the chapter's own description of exactly this signature, and explains specifically why this check is a single fast lookup rather than a resource-by-resource investigation -- exactly the reasoning behind the chapter's own recommendation to check this "first," before sinking time into the usual-suspects list.