In theDesigning and Implementing Enterprise Network Assurance (300-445 ENNA)curriculum, isolating performance issues on end-user machines requires a combination of application-layer experience data and local system telemetry. When an architect suspects that local hardware constraints, such as high CPU usage, are degrading the digital experience, theEndpoint Agentis the required vantage point.

The correct combination isReal User Tests > Endpoint, CPU utilization ≥ %(Option C). This alert configuration is effective for several reasons:

Targeted Visibility:It directly monitors the user's device (Endpoint) where the hardware bottleneck is suspected to reside.

Real-Time Context:By utilizingReal User Tests (RUM), the agent gathers performance data during actual user activity (e.g., browsing the web application). This ensures that the CPU spikes are correlated with active application usage, providing a representative view of the impact on experience.

Threshold Alerting:The condition monitors for CPU utilization exceeding a defined percentage threshold (≥ %). This allows IT teams to be notified only when the CPU load reaches problematic levels that are known to cause application sluggishness or browser "freezing".

Alternative options are less effective for this specific troubleshooting goal:

Option A:Monitors network loss, which would not identify a local CPU bottleneck.

Option B:Monitors path length (hops), which is a routing metric irrelevant to local hardware performance.

Option D:Monitors memory load during scheduled tests. While memory is a factor, the specific suspicion in this scenario is CPU utilization, and scheduled tests do not always capture the same load impact as a real user interacting with the browser.