Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

An enterprise application uses a proprietary TCP-based protocol to process transactions. The application runs on Amazon EC2 instances within private subnets, managed by an Auto Scaling group (ASG) behind a Network Load Balancer (NLB). The application daemon listens on TCP port 7001 for transaction traffic, while a separate monitoring service on the same instances listens on TCP port 7005 to report health status. Currently, the NLB target group is configured to use the TCP protocol, with the health check port set to 'traffic-port'. The target group health checks are failing, causing the NLB to mark all instances as unhealthy and prevent transaction routing. The Security Group assigned to the EC2 instances permits inbound TCP traffic on ports 7001 and 7005 from the VPC CIDR. The subnets use a custom Network Access Control List (NACL) that permits inbound TCP traffic on ports 7001 and 7005 from the VPC CIDR, but contains no outbound rules other than the default deny rule. Which combination of actions should a Solutions Architect take to resolve the health check failure and allow transactions to flow? (Select two.)

  1. Update the target group configuration to specify port 7005 as the health check port instead of using the traffic port.Answer
  2. Add an outbound rule to the subnet's Network ACL allowing TCP traffic to the ephemeral port range (1024–65535) to handle return traffic.Answer
  3. C
    Add an outbound rule to the EC2 instances' security group allowing TCP traffic to the ephemeral port range (1024–65535) to the VPC CIDR.
  4. D
    Change the target group protocol to HTTP and set the health check path to /health on port 7005.
  5. E
    Configure a Route 53 latency routing policy to route traffic directly to the private IP addresses of the EC2 instances in the Auto Scaling group.

Answer

Update the target group configuration to specify port 7005 as the health check port instead of using the traffic port, and add an outbound rule to the subnet's Network ACL allowing TCP traffic to the ephemeral port range (1024–65535) to handle return traffic.
The target group must be configured to probe port 7005, which is where the health status service is running, rather than the default traffic port (port 7001). Additionally, because Network ACLs are stateless, any inbound request (such as a health check or transaction request) requires an explicit outbound rule to allow the response traffic to return to the client's or load balancer's ephemeral ports (1024–65535). Configuring these two changes resolves the communication block and allows the load balancer to accurately verify instance health and route client traffic.

Step-by-Step Solution

1
Analyze the health check port mismatch.
Identify that the daemon listens for transactions on port 7001 but health checks are on port 7005. Since the target group is configured to use 'traffic-port' (port 7001), the NLB is probing the wrong port, causing health check failures.
Health check probes must be sent to the port where the monitoring service is actively listening.
2
Analyze the Network ACL configurations.
Identify that the custom NACL has no outbound rules other than the default deny rule. Because NACLs are stateless, they do not automatically allow return traffic for established inbound connections.
To allow the EC2 instances to respond to health checks and clients, an outbound NACL rule is required to permit traffic to the ephemeral ports (1024-65535) used by the source initiators.
3
Evaluate the stateful nature of Security Groups.
Determine that the Security Group assigned to the EC2 instances does not need outbound rule modifications for return traffic because Security Groups are stateful and automatically allow return traffic.
Modifying security group outbound rules for ephemeral port return traffic is unnecessary and does not resolve stateless NACL blocks.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB)
Estimated Time:2m 30s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic