Examkin

Question

Difficulty: Very hardAuto Scaling and Elastic Load Balancing (ELB)

A gaming company hosts a multiplayer online battle arena (MOBA) game server backend on Amazon EC2 instances managed by an Auto Scaling group (ASG) in private subnets. The game server application communicates using UDP port 7777. To route incoming traffic with ultra-low latency, a solutions architect deploys a Network Load Balancer (NLB) in public subnets. The target group is configured to register the EC2 instances by Instance ID. The solutions architect has configured the security group of the EC2 instances to allow inbound UDP traffic on port 7777 from the client IP ranges. However, the NLB is marking all EC2 instances as unhealthy, and clients are unable to connect to the game servers. Which two actions should the solutions architect take to resolve the health check issues and allow client traffic? (Select two.)

  1. Configure the target group health check to use the TCP or HTTP protocol on a dedicated port, such as port 8080, and run a health status service on that port on the EC2 instances.Answer
  2. Add a rule to the EC2 instances' security group to allow inbound TCP traffic on the designated health check port from the private IP addresses of the NLB.Answer
  3. C
    Modify the target group health check settings to use the UDP protocol on port 7777.
  4. D
    Add a rule to the EC2 instances' security group allowing inbound UDP traffic on the health check port from the external client IP ranges.
  5. E
    Configure an Amazon Route 53 latency routing policy to direct client traffic to the EC2 instances' private IP addresses, bypassing the NLB.

Answer

To resolve the health check issues and allow client traffic, the solutions architect must configure the target group health check to use the TCP or HTTP protocol on a dedicated port, run a health status service on that port on the EC2 instances, and add a rule to the EC2 instances' security group to allow inbound TCP traffic on that designated health check port from the private IP addresses of the NLB.
To resolve the health check issues and allow client traffic, the solutions architect must configure a TCP- or HTTP-based health check on a dedicated port on the EC2 instances, and update the EC2 instances' security group to allow inbound TCP traffic on that health check port from the NLB's private IP addresses. Because Network Load Balancers (NLB) do not support UDP health checks, a separate TCP/HTTP listening service is required on the instances. Additionally, health checks originate directly from the NLB nodes' private IP addresses, requiring the security group to permit this traffic.

Step-by-Step Solution

1
Analyze health check protocol limitations for Network Load Balancer (NLB) UDP target groups.
Identify that UDP-based health checks are unsupported; the target group health check protocol must be TCP, HTTP, or HTTPS.
Since UDP is stateless, it cannot verify target availability through standard handshakes, necessitating a TCP/HTTP listener for checks.
2
Determine the service configuration required on the EC2 instances.
Establish a separate TCP or HTTP service on a dedicated port (e.g., port 8080) on the EC2 instances to report health status.
The main game application uses UDP port 7777, so a separate port running a TCP/HTTP listener must respond to health checks.
3
Configure the security groups of the EC2 targets to allow health check traffic.
Add a rule to the EC2 instances' security group permitting inbound TCP traffic on the health check port from the NLB's private IP addresses.
Unlike client traffic (where client IP is preserved when registering by Instance ID), NLB health checks originate directly from the NLB's internal private IP addresses.

Key Concept

Network Load Balancer health checks for UDP target groups and target security group configuration.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic