Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a security-hardened metadata retrieval service on a fleet of Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on TCP port 84438443, while a local diagnostic agent listens on TCP port 80808080 to respond with node status. The solutions architect configures the ALB target group with default health check settings. Custom Network ACLs (NACLs) and security groups are applied to the EC2 instances. During testing, the ALB marks all registered instances as unhealthy, even though local status checks on port 80808080 succeed. Additionally, after a recent failover to a secondary region due to network latency, Route 53 fails to route clients back to the primary region's ALB after its instances recover.

Which combination of configuration changes should the solutions architect implement to resolve these issues? (Select two.)

  1. Modify the target group health check settings to query port 80808080 instead of the default traffic port.Answer
  2. Add an outbound rule to the subnet network ACL to allow outbound traffic to the ALB subnets on ephemeral ports 1024−655351024-65535.Answer
  3. C
    Configure the target group health check settings to query port 8080 to verify baseline web server socket availability.
  4. D
    Add an outbound rule to the EC2 security group allowing traffic to the ALB security group on ephemeral ports 1024−655351024-65535.
  5. E
    Update the Route 53 latency routing policy to failover using TTL records without configuring health checks.

Answer

To resolve the health check failure, update the target group health check settings to query port 80808080 instead of the default traffic port, and add an outbound rule to the stateless subnet network ACL to allow return traffic to the ALB subnets on ephemeral ports 1024−655351024-65535.
The diagnostic agent runs on port 80808080, so the target group health check port must be explicitly updated to query port 80808080 instead of defaulting to the application traffic port of 84438443. Additionally, since network ACLs are stateless, an outbound rule must be added to the subnet network ACL to allow return traffic from the EC2 instances to the ALB subnets on ephemeral ports 1024−655351024-65535.

Step-by-Step Solution

1
Analyze the health check port configuration.
Identify that the health check is defaulting to the application traffic port (84438443) instead of the diagnostic agent port (80808080).
The target group must be modified to query port 80808080 explicitly so that the health check reaches the correct service.
2
Evaluate network access control lists (NACLs) and security group rules.
Recognize that the stateless subnet network ACL blocks return outbound traffic to the ALB because there is no rule allowing outbound traffic on ephemeral ports.
A stateless network ACL requires explicit rules for both inbound and outbound traffic paths, unlike stateful security groups.
3
Formulate the correction for the network ACL.
Create an outbound network ACL rule allowing traffic to the ALB subnets on ephemeral ports 1024−655351024-65535.
This allows return packets from the EC2 instances to reach the ALB subnets and satisfy the health check.

Key Concept

Auto Scaling and Elastic Load Balancing health checks, stateless vs stateful network filtering, and Route 53 failover health check requirements.
Estimated Time:2m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic