Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

An enterprise application runs on Amazon EC2 instances inside a private subnet. These instances are managed by an Auto Scaling group (ASG) and receive traffic from an Application Load Balancer (ALB). The primary application is configured to listen on port 5000, while a dedicated monitoring daemon on each instance handles status reporting on port 5001. Currently, the target group health checks are targeted at port 5001. The ALB marks all new instances as unhealthy, yet the ASG fails to terminate or replace them. The security group on the EC2 instances is configured to accept inbound TCP connections on port 5000 from the ALB's security group. Which two modifications will resolve these issues and ensure unhealthy instances are automatically replaced? (Select two.)

  1. Allow inbound TCP traffic on port 5001 from the Application Load Balancer's security group in the EC2 instances' security groupAnswer
  2. Modify the Auto Scaling group's health check configuration to use Elastic Load Balancing (ELB) health checks instead of EC2 health checksAnswer
  3. C
    Add an inbound rule to the subnet's Network Access Control List (NACL) to allow traffic on port 5001, and remove the port 5001 allowance from the security group
  4. D
    Change the target group health check port configuration to port 80 to align with standard HTTP health check protocols
  5. E
    Configure an Amazon Route 53 latency routing policy to route user requests directly to individual EC2 instance IP addresses when they fail load balancer health checks

Answer

Allow inbound TCP traffic on port 5001 from the Application Load Balancer's security group in the EC2 instances' security group, and modify the Auto Scaling group's health check configuration to use Elastic Load Balancing (ELB) health checks instead of EC2 health checks.
The correct options resolve both issues. First, allowing inbound TCP traffic on port 5001 from the Application Load Balancer's security group within the EC2 instances' security group opens the necessary communication path for the load balancer to query the monitoring daemon. Second, configuring the Auto Scaling group to use ELB health checks ensures the Auto Scaling group is aware of health status changes from the load balancer, enabling it to automatically terminate and replace instances that fail the target group health checks.

Step-by-Step Solution

1
Analyze why the Application Load Balancer is marking instances as unhealthy.
The target group is querying port 5001 for health checks, but the EC2 instances' security group only allows inbound traffic on port 5000. Traffic to port 5001 is being blocked.
Security groups are stateful firewalls at the instance level. An inbound rule must explicitly allow the load balancer to reach the health check port.
2
Analyze why the Auto Scaling group is not replacing the unhealthy instances.
By default, Auto Scaling groups use EC2 status checks (hardware and system status) to determine instance health. They do not automatically recognize Application Load Balancer target group health check failures.
Changing the health check type to ELB tells the Auto Scaling group to monitor target group health status and replace instances when they are marked unhealthy by the load balancer.

Key Concept

Auto Scaling Group health check types and Elastic Load Balancing target group security group rules.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic