Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A logistics company is deploying a telemetry receiver API on Amazon EC2 instances. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The API is configured to listen on TCP port 50051. The ALB is configured with an HTTPS listener that routes traffic to a target group associated with the ASG. After deploying the application, the solutions architect notices that the ALB target group shows all EC2 instances as unhealthy. The security group associated with the EC2 instances currently allows inbound traffic on port 50051 from the ALB security group, and outbound traffic to all destinations. Which combination of actions should the solutions architect take to resolve this issue and ensure the instances are marked healthy? (Select two.)

  1. Modify the target group's health check settings to use port 50051 instead of the default port.Answer
  2. Configure the Application Load Balancer's security group to allow outbound TCP traffic on port 50051 to the security group of the EC2 instances.Answer
  3. C
    Override the target group health check port to port 80, since Elastic Load Balancing requires health check traffic to use standard web ports.
  4. D
    Add a rule to the subnet's Network ACL to allow inbound traffic on port 50051, as Security Groups are stateless and require explicit network-level rules to permit return traffic.
  5. E
    Configure an Amazon Route 53 latency routing policy to route client requests directly to the EC2 instances, bypassing the Application Load Balancer when targets are marked unhealthy.

Answer

Modify the target group's health check settings to use port 50051, and configure the Application Load Balancer's security group to allow outbound TCP traffic on port 50051 to the security group of the EC2 instances.
The target group must be configured to send health check requests to port 50051 because that is where the telemetry service is listening. Since the default health check port is port 80 (or the traffic port if not overridden, but here it defaults to HTTP/80), the load balancer was sending health checks to a port where no service was listening. Additionally, the Application Load Balancer's security group must be configured to allow outbound traffic to the EC2 instances on port 50051. While the EC2 instances' security group allowed inbound traffic, security groups on the load balancer must also permit the outbound connection to the targets.

Step-by-Step Solution

1
Analyze the health check configuration of the target group.
Identify that the default target group health check port (or port 80) does not match the application's port of 50051.
Health check requests must be routed to the port where the service is active to determine its health status.
2
Check the outbound security group rules for the Application Load Balancer.
Identify that the ALB security group does not allow outbound TCP traffic to the EC2 instances on port 50051.
The ALB must be permitted to initiate connections to the EC2 instances on the traffic port to perform health checks and route client traffic.
3
Verify security group statefulness and Network ACL rules.
Confirm that security groups are stateful, meaning outbound response traffic is allowed automatically without modifying Network ACLs.
Avoids introducing unnecessary and overly permissive Network ACL rules based on statefulness misconceptions.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) health check configurations, port overrides, and secure security group communication paths.
Estimated Time:2m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic