SOA-C02 Monitoring, Logging, and Remediation Practice Question
A SysOps administrator is troubleshooting an application that runs on an EC2 instance. The application is experiencing high latency, and the administrator suspects a memory leak. Which metrics should the administrator examine first?
⚠ Common exam trap
Many candidates assume default EC2 metrics include memory utilization, but AWS does not provide guest OS memory metrics by default; you must install the CloudWatch agent to capture them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.
A memory leak causes the application to consume increasing amounts of memory over time, leading to high latency as the OS begins swapping or the kernel reclaims memory. The CloudWatch agent can publish custom metrics like `mem_used_percent`, which directly tracks memory usage percentage and is the most relevant metric to confirm a memory leak. Default EC2 metrics do not include memory utilization, so the administrator must rely on custom metrics from the CloudWatch agent.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Custom CloudWatch metrics published by the CloudWatch agent, such as mem_used_percent.
Why this is correct
The CloudWatch agent runs inside the EC2 instance as an OS-level service, so it can read the guest operating system's /proc/meminfo and report memory utilization as a custom metric in the CWAgent namespace (e.g., mem_used_percent). It uses the PutMetricData API and requires an IAM role with CloudWatchAgentServerPolicy to publish metrics. Default hypervisor-level EC2 metrics never expose guest memory, which is why installing the agent is the standard way to get memory utilization in CloudWatch.
- ✗
CloudWatch metrics from the Detailed Monitoring feature, such as DiskReadOps.
Why it's wrong here
Detailed Monitoring changes the collection period of EC2 hypervisor metrics from 5 minutes to 1 minute, but it does not add new metric categories. DiskReadOps is a disk I/O counter measured by the hypervisor (or Nitro controller), and it has no relation to RAM consumption; memory is not accessible to the hypervisor because the guest OS manages its own memory pages. Therefore, even with Detailed Monitoring enabled, CloudWatch still lacks an EC2 memory metric, so relying on DiskReadOps would not diagnose an out-of-memory condition.
- ✗
CloudWatch metrics for the instance's Elastic Network Interface.
Why it's wrong here
Elastic Network Interface metrics in CloudWatch (e.g., NetworkPacketsIn, NetworkBytesOut) are emitted per ENI and represent traffic counters, not process memory usage. These metrics come from the virtual network adapter and reflect packet-level activity, which has no correlation with the amount of RAM consumed by the application. Using ENI metrics for memory troubleshooting is invalid because they measure I/O throughput of the network path, not the state of the guest OS's memory allocation.
- ✗
CloudWatch default EC2 metrics, such as CPUUtilization and NetworkIn.
Why it's wrong here
Default EC2 metrics, such as CPUUtilization and NetworkIn, are collected by the hypervisor (or Nitro security chip) and expose only host-visible resource usage. The hypervisor cannot see the guest OS's free/used pages, so memory is omitted from the standard AWS/EC2 namespace; no default metric covers it. Thus, checking CPUUtilization or NetworkIn may show overall load but will not reveal memory pressure like a kswapd-heavy swap storm or OOM-killer events, making these default metrics inadequate for that troubleshooting scenario.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.