Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

A solutions architect is designing a high-performance web application. The application tier runs on Amazon EC2 instances inside an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The application listens on a custom port 84438443. The ALB is configured with a target group targeting the EC2 instances. The solutions architect configures the security group of the EC2 instances to accept incoming TCP traffic on port 84438443 from the ALB's security group. However, the instances are showing as unhealthy in the target group, and users receive a HTTP 502502 Bad Gateway error. The subnets containing the EC2 instances are associated with a custom Network Access Control List (Network ACL). Which TWO configurations must the solutions architect verify or modify to resolve the health check issues and restore service? (Select two.)

  1. Configure the health check port in the ALB target group settings to use port 84438443 instead of the default port.Answer
  2. Verify that the custom Network ACL has an inbound rule allowing traffic on port 84438443 and an outbound rule allowing traffic on ephemeral ports 1024−655351024-65535 for the EC2 subnet.Answer
  3. C
    Modify the EC2 instances' security group to allow inbound traffic on port 8080, as target group health checks are always forwarded to port 8080 by default regardless of target group configurations.
  4. D
    Change the subnet Network ACL to be stateful so that return traffic from the EC2 instances to the ALB is automatically allowed without requiring an explicit outbound rule.
  5. E
    Configure Amazon Route 53 with a latency routing policy pointing to the ALB to bypass the unhealthy targets when health checks fail.

Answer

The solutions architect must configure the health check port in the target group settings to use port 84438443, and verify that the custom Network ACL allows inbound traffic on port 84438443 and outbound traffic on ephemeral ports 1024−655351024-65535 for the EC2 subnet.
The correct options involve configuring the target group health check to point to the actual application port (port 84438443) and ensuring that the stateless Network ACL has rules allowing inbound traffic on port 84438443 and outbound traffic on the ephemeral port range (1024−655351024-65535) to allow health check probes and responses to pass successfully.

Step-by-Step Solution

1
Analyze target group health check configuration.
Identify that because the application is listening on custom port 84438443, health checks targeting the default port (like port 8080) will fail if the instances do not listen on port 8080.
Health checks must target the correct port on which the web application is running to verify its status.
2
Review Network ACL behavior and rules.
Determine that Network ACLs are stateless, which requires outbound traffic rules for response traffic on ephemeral ports (1024−655351024-65535) in addition to inbound traffic rules.
Since the ALB communicates with the target group, the subnet containing the EC2 instances must allow return traffic to the ALB's ephemeral ports.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) Target Health Checks and Stateless Network Security with Network ACLs
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic