SOA-C02 Monitoring, Logging, and Remediation Practice Question

Network Topology

Refer to the exhibit. A SysOps administrator runs the command and sees the output. The administrator then creates a CloudWatch alarm on the CPUUtilization metric for this instance, but the alarm state remains 'INSUFFICIENT_DATA'. What is a likely cause?

⚠ Common exam trap

It's easy for candidates to assume INSUFFICIENT_DATA always means a configuration issue (like missing detailed monitoring or wrong region), when in fact it often indicates the resource itself is not running and therefore not emitting any metrics.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The EC2 instance is stopped or terminated.

The command output shows the instance state is 'stopped'. CloudWatch cannot retrieve metrics from a stopped or terminated EC2 instance because the hypervisor is no longer running the instance's operating system or collecting CPU utilization data. When no metric data points are received for the configured alarm period, the alarm transitions to 'INSUFFICIENT_DATA' state.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Detailed monitoring is not enabled.
Why it's wrong here
Detailed monitoring is not the cause because basic monitoring already delivers EC2 metrics, including CPUUtilization, to CloudWatch every 5 minutes. The CloudWatch API will return those 5-minute datapoints even when detailed monitoring (which changes the granularity to 1 minute) is never enabled. Since the command is querying the default period of 300 seconds (or any period that matches available buckets), basic monitoring alone is sufficient for data to appear.
✓
The EC2 instance is stopped or terminated.
Why this is correct
When an EC2 instance is stopped, the hypervisor shuts down the guest OS and the instance's metadata and metric collection process no longer runs, so CloudWatch stops receiving any instance-specific metrics such as CPUUtilization. For a terminated instance, the same is true and the metrics are permanently gone because there is no instance to emit them. The stop action does not delete the EBS volume, but it does stop all CPU-based metric publication; therefore checking the instance state is a direct and correct explanation for an empty output.
✗
The instance is in a different AWS region.
Why it's wrong here
The instance is not in a different region because the command is run in us-east-1 and the exhibit shows the instance is also in us-east-1. CloudWatch metrics are per-region: if the instance were in another region, its CPUUtilization data would only appear under that region's CloudWatch namespace, not under us-east-1. Since both the CLI call and the instance are in us-east-1, a Region mismatch cannot explain the missing datapoints.
✗
The metric name is misspelled.
Why it's wrong here
The metric name is not misspelled because the exact metric for EC2 CPU utilization is 'CPUUtilization' with the namespace 'AWS/EC2', and the command uses that correct case-sensitive name. CloudWatch metric names are case-sensitive, and a misspelled name would return an empty dataset, but here the name is accurate. The option is therefore not the source of the problem; a typo would be an obvious API-level mismatch, not a silent condition tied to instance lifecycle.

Go deeper

SOA-C02 Monitoring, Logging, and Remediation Practice Question

Why each option matters

Option-by-option breakdown

Related to this question