Examkin

Question

Difficulty: EasyAuto Scaling and Elastic Load Balancing (ELB)

A healthcare clinic hosts a patient scheduling application on a fleet of Amazon EC2 instances. The instances are registered with a target group for an Application Load Balancer (ALB) and managed by an Auto Scaling group. The clinic's IT team reports that the ALB target group shows all EC2 instances as unhealthy, preventing patients from accessing the portal. However, verification confirms that the web service is running normally on the instances themselves. What is the most likely cause of this behavior?

  1. A
    The security group for the EC2 instances is blocking the outbound return health check traffic because security groups are stateless.
  2. B
    The target group is querying the default port 80 for health checks, and Elastic Load Balancing does not support custom ports for health check configurations.
  3. C
    Amazon Route 53 latency-based routing is blocking health checks to the instances because the domain name is not configured with a failover routing policy.
  4. The security group for the EC2 instances does not allow inbound traffic from the security group of the Application Load Balancer.Answer

Answer

The security group for the EC2 instances does not allow inbound traffic from the security group of the Application Load Balancer.
For an Application Load Balancer to successfully perform health checks, the security group assigned to the registered EC2 instances must explicitly permit inbound traffic from the Application Load Balancer's security group on the application's port. Since security groups are stateful, return traffic is automatically allowed.

Step-by-Step Solution

1
Identify where the failure is occurring.
The target group health checks are failing, meaning the Application Load Balancer cannot reach the instances on the health check port.
Since the application runs fine locally, the problem lies in network connectivity or permissions between the ALB and the EC2 instances.
2
Evaluate security configurations governing internal traffic between the ALB and EC2 instances.
Confirm that the security group of the EC2 instances must allow inbound traffic from the ALB's security group on the application port.
By default, security groups block all inbound traffic unless explicitly permitted. If the EC2 instances do not allow inbound traffic from the ALB, health checks will fail.

Key Concept

Elastic Load Balancing health checks and Security Group rules
Estimated Time:1m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic