Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company runs a specialized order processing backend application on Amazon EC2 instances. The EC2 instances are in private subnets, managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application receives transaction requests on TCP port 8443. The application exposes a health check endpoint on HTTP port 8080. Currently, the ALB is marking all EC2 instances as unhealthy, and client requests are failing with 502 Bad Gateway errors.

Which two configuration changes are required to resolve this issue and restore service availability? (Select two.)

  1. Configure the target group health checks to use port 8080 instead of the default traffic port.Answer
  2. Add an inbound rule to the EC2 instances' security group that allows TCP traffic on port 8080 from the security group of the Application Load Balancer.Answer
  3. C
    Update the target group health checks to use the default 'traffic port' setting so the Application Load Balancer can verify target health on port 8443.
  4. D
    Configure a stateless inbound rule on the subnet Network Access Control List (NACL) to permit traffic on port 8080, which automatically overrides the EC2 security group rules.
  5. E
    Configure an Amazon Route 53 latency routing policy to route traffic directly to the public IP addresses of the EC2 instances, bypassing the Application Load Balancer.

Answer

The target group health checks must be configured to use port 8080, and the EC2 instances' security group must allow inbound TCP traffic on port 8080 from the Application Load Balancer's security group.
To resolve the health check failure, the target group's health check configuration must be updated to target the custom port where the health check endpoint is exposed. In addition, the security group attached to the EC2 instances must permit inbound TCP traffic on that health check port from the security group of the Application Load Balancer.

Step-by-Step Solution

1
Analyze the application port configuration and identify the mismatch.
The application listens on port 8443, but the health check endpoint runs on port 8080. The target group must be modified to query port 8080 for health checks instead of using the default traffic port.
By default, the load balancer health checks query the traffic port (8443), which leads to failures since the health check service is not bound to that port.
2
Inspect the security group rules between the Application Load Balancer and the EC2 instances.
The EC2 instances' security group must explicitly allow inbound traffic from the Application Load Balancer's security group on port 8080.
Security groups are stateful and block all inbound traffic by default. Even if the target group is correctly pointed to port 8080, the health check requests will be dropped at the instance level if the security group does not permit them.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) health checks and security group integration
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic