Examkin

Question

Difficulty: Very hardAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a latency-sensitive API on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The API processes user transactions on TCP port 8443. A separate monitoring agent on each instance listens on TCP port 9999 to report service health metrics. The ALB's target group is configured to perform health checks on port 9999. The subnet's stateless Network Access Control List (NACL) allows inbound TCP traffic on port 8443 from all sources and allows all outbound traffic.

To meet security compliance, a security engineer modifies the subnet NACL's outbound rule to only allow outbound TCP traffic to port 8443. Immediately after this change, the ALB marks all instances in the target group as unhealthy. Furthermore, Route 53, which is configured with latency-based routing policies to distribute traffic between this Region and another active Region, continues to send client requests to the unhealthy ALB.

Which combination of actions will restore the target health status and ensure Route 53 diverts traffic away from this Region during a failure? (Select two.)

  1. Modify the subnet Network ACLs to allow inbound TCP traffic on port 9999 and outbound TCP traffic to ephemeral ports (1024-65535).Answer
  2. Configure 'Evaluate Target Health' to Yes on the Route 53 alias records that point to the Application Load Balancer.Answer
  3. C
    Change the target group health check port to use the default traffic port (8443) and modify the subnet Network ACLs to allow inbound TCP traffic on port 8443.
  4. D
    Add an outbound rule to the EC2 instances' security group allowing TCP traffic on port 9999, and configure the target group health check to use the default traffic port.
  5. E
    Replace the Route 53 latency-based routing policies with failover routing policies, as latency routing does not support health checking or automatic failover.

Answer

Modify the subnet Network ACLs to allow inbound TCP traffic on port 9999 and outbound TCP traffic to ephemeral ports (1024-65535), and configure 'Evaluate Target Health' to Yes on the Route 53 alias records that point to the Application Load Balancer.
The correct solution requires configuring the stateless subnet Network ACLs to allow the inbound health check traffic on port 9999 and the outbound return traffic to the load balancer's ephemeral ports (1024-65535). Additionally, enabling 'Evaluate Target Health' on the Route 53 alias records ensures that Route 53 monitors the health of the targets behind the Application Load Balancer and diverts traffic to the healthy Region if all targets are unhealthy.

Step-by-Step Solution

1
Analyze the health check failure caused by the outbound Network ACL rule modification.
The ALB health check queries port 9999. Since the subnet Network ACL is stateless, restricting outbound traffic to port 8443 prevents the EC2 instances from sending TCP responses back to the ALB's health check requests.
Stateless Network ACLs require explicit rules for both inbound request traffic and outbound return traffic.
2
Determine the necessary Network ACL rules to allow the health check traffic.
An inbound rule must allow TCP port 9999 traffic from the ALB, and an outbound rule must allow TCP traffic to ephemeral ports (1024-65535) back to the ALB.
The ALB initiates connections to port 9999 from its ephemeral ports, which requires the return traffic to be allowed outbound.
3
Determine why Route 53 continues routing traffic to the unhealthy Region.
Route 53 latency-based routing distributes traffic based on latency but does not automatically monitor endpoint health unless explicitly configured.
Route 53 alias records pointing to Application Load Balancers must have 'Evaluate Target Health' set to Yes to dynamically fail over when the backend targets are unhealthy.

Key Concept

Configuring health checks and routing for resilience with stateless Network ACLs and Route 53 latency-based routing.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic