Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a web application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The EC2 instances reside in a private subnet, and the ALB is in a public subnet. The application is configured to listen on port 8080. A security engineer updates the private subnet's Network Access Control List (NACL) to allow inbound traffic from the public subnet on TCP port 8080, and outbound traffic to the public subnet on TCP port 8080. Shortly after, the ALB target group health checks begin failing, and the EC2 instances are marked unhealthy. What is the reason for this health check failure?

  1. Network ACLs are stateless, and the outbound Network ACL is blocking the return traffic because it does not allow traffic to the ephemeral ports used by the ALB.Answer
  2. B
    The EC2 instance security group is blocking the return traffic to the ALB because security groups are stateless and require an explicit outbound rule for ephemeral ports.
  3. C
    The ALB target group health check is configured to use the default 'traffic-port', which causes a port mismatch since the application is listening on port 8080.
  4. D
    Amazon Route 53 is using a latency routing policy to direct health check requests, which bypasses the target group and attempts to query the instances directly on port 80.

Answer

Network ACLs are stateless, and the outbound Network ACL is blocking the return traffic because it does not allow traffic to the ephemeral ports used by the ALB.
The correct answer identifies that Network ACLs (NACLs) are stateless. When the Application Load Balancer sends a health check request from an ephemeral port to the instances on port 8080, the request is allowed inbound. However, because NACLs are stateless, the return traffic from the instances back to the ALB's ephemeral port range (1024-65535) is blocked by the outbound NACL, which is restricted to port 8080. Opening the outbound NACL to ephemeral ports resolves the issue.

Step-by-Step Solution

1
Identify the key network security component mentioned in the failure.
The scenario focuses on the update to the Network Access Control List (NACL) of the private subnet.
Since the health check failures began immediately after the NACL change, the root cause must be related to the stateless nature of NACLs.
2
Analyze how stateless network devices process traffic flow.
Inbound rules allow the request in, but outbound rules must explicitly permit the response to go back to the source port (ephemeral ports 1024-65535).
Because the outbound NACL was only configured to allow port 8080, it blocked the return traffic to the ALB.
3
Differentiate security groups from NACLs.
Security groups are stateful and automatically permit return traffic, while NACLs require explicit two-way configuration.
This confirms the issue lies solely with the stateless Network ACL configuration.

Key Concept

Understanding the stateless nature of Network Access Control Lists (NACLs) and how they affect Elastic Load Balancing (ELB) health check traffic.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic