Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a microservice on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The EC2 instances are located in private subnets, and the ALB is in public subnets. The application on the EC2 instances listens on TCP port 8080. A custom Network ACL (NACL) is applied to the private subnets. The solutions architect notices that the ALB target group marks all EC2 instances as unhealthy, and clients receive HTTP 502 Bad Gateway errors. The security groups for both the ALB and the EC2 instances are configured to allow traffic on port 8080. Which configuration change is required to resolve this issue and restore healthy status to the target group?

  1. A
    Add an outbound rule to the EC2 instances' security group allowing TCP traffic on ephemeral ports to the ALB, because security group rules are stateless.
  2. B
    Reconfigure the target group health check port to TCP port 80, as the ALB listener is configured to receive HTTP traffic on port 80.
  3. Add an outbound rule to the private subnet Network ACL that allows TCP traffic on ephemeral ports (1024-65535) to the public subnets.Answer
  4. D
    Modify the Amazon Route 53 routing policy to use Latency Routing with health checks enabled to automatically route the ALB health check probes to healthy instances.

Answer

Add an outbound rule to the private subnet Network ACL that allows TCP traffic on ephemeral ports (1024-65535) to the public subnets.
The correct option is to add an outbound rule to the private subnet Network ACL that allows TCP traffic on ephemeral ports (1024-65535) to the public subnets. Because Network ACLs are stateless, return traffic from the EC2 instances back to the ALB must be explicitly allowed. When the ALB sends a health check request to port 8080 on the instances, the return traffic from port 8080 goes back to the ALB's ephemeral ports.

Step-by-Step Solution

1
Analyze the components and the flow of the health check requests.
The Application Load Balancer (ALB) in the public subnet sends health check requests to the EC2 instances in the private subnet on port 8080.
Health check probes are initiated by the ALB and targeted at the configured port of the backend instances.
2
Examine the statefulness of the security groups and Network ACLs.
Security groups are stateful and allow return traffic automatically. Network ACLs (NACLs) are stateless, meaning both inbound and outbound traffic must be explicitly allowed.
Since a custom NACL is applied to the private subnets, any return traffic generated by the EC2 instances in response to the health check probes must be allowed explicitly by an outbound NACL rule.
3
Identify the ports required for the return traffic.
The return traffic from the EC2 instances (destined for the ALB's client request port) must be sent to the ephemeral ports (1024-65535) of the ALB subnets.
When a client or load balancer initiates a connection, it uses an ephemeral port. The server responds back to this ephemeral port, requiring the private subnet's NACL to permit outbound ephemeral traffic.

Key Concept

Understanding the stateless nature of Network ACLs compared to stateful Security Groups when configuring health checks between an ALB and backend targets.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic