Examkin

Question

Difficulty: Very hardAuto Scaling and Elastic Load Balancing (ELB)

A financial services company has deployed a secure three-tier web application. The application tier runs on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on custom TCP port 84438443. The security team has configured Network ACLs (NACLs) to allow only HTTPS traffic on TCP port 443443 between the ALB subnets and the application subnets. The ALB target group has health checks configured to query TCP port 84438443. After deployment, the operations team notices that all EC2 instances are repeatedly marked as unhealthy by the target group and subsequently terminated and replaced by the ASG, even though local tests confirm the application process is running and responding on port 84438443. Which of the following configuration modifications will resolve the health check failures and stabilize the Auto Scaling group?

  1. Update the Network ACLs to allow outbound traffic on TCP port 84438443 from the ALB subnets and inbound traffic on TCP port 84438443 to the application subnets, while also allowing traffic on ephemeral TCP ports 10241024-6553565535 in both directions to accommodate stateless return communication.Answer
  2. B
    Change the target group health check port configuration to standard TCP port 8080 or 443443, allowing the ALB to perform health checks on standard web ports while client traffic continues to flow to the application on port 84438443.
  3. C
    Configure the application instances' security groups to be stateless to allow inbound traffic on port 84438443, and modify the Network ACLs to be stateful so they automatically permit the returning ephemeral port traffic from the instances to the ALB.
  4. D
    Configure Amazon Route 53 Latency routing with active-passive failover to redirect client requests directly to a secondary static page, bypass the ALB's health check threshold settings, and configure the ASG to use EC2 health checks instead of ELB health checks.

Answer

Update the Network ACLs to allow outbound traffic on TCP port 84438443 from the ALB subnets and inbound traffic on TCP port 84438443 to the application subnets, while also allowing traffic on ephemeral TCP ports 10241024-6553565535 in both directions to accommodate stateless return communication.
The correct solution involves modifying the stateless Network ACLs to allow the traffic on port 84438443 between the ALB subnets and the application subnets, along with allowing return traffic on the ephemeral port range (10241024-6553565535). Because NACLs are stateless, they evaluate traffic in each direction independently, meaning rules must cover both the outbound/inbound request path and the inbound/outbound response path.

Step-by-Step Solution

1
Analyze the application port and protocol configuration.
The application listens on custom TCP port 84438443, and the ALB target group is configured to run health checks on this same port (84438443).
This establishes that traffic from the ALB to the instances for both health checks and standard routing must use port 84438443.
2
Examine the Network ACL (NACL) rules currently in place.
The NACLs are currently configured to only allow HTTPS traffic on port 443443 between the subnets.
Because NACLs are stateless, they must explicitly allow both the request and response paths for any network connection. Since the traffic between the ALB and the targets is on port 84438443, the current rules block this traffic.
3
Formulate the required NACL updates.
Inbound rules for application subnets must allow port 84438443 from the ALB subnet. Outbound rules for ALB subnets must allow port 84438443 to the application subnets. Return traffic must be allowed on ephemeral ports (10241024-6553565535) in both directions.
This ensures the ALB can successfully send health check requests and application traffic to the targets on port 84438443 and receive the responses back, resolving the health check failure.

Key Concept

Understanding Elastic Load Balancing target group health checks on custom ports and the stateless nature of Network ACLs in an AWS VPC.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic