Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a containerized backend application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on custom port 8443, and the ALB terminates SSL/TLS on port 443. The solutions architect notices two issues: first, when instances fail internally, the ALB marks them as unhealthy, but the ASG continues to treat them as healthy and does not replace them; second, newly launched instances fail health checks immediately because traffic is blocked between the ALB and the instances. Which actions should the solutions architect take to resolve these issues and ensure a resilient architecture? (Select two.)

  1. Update the health check type of the Auto Scaling group from EC2 to ELB.Answer
  2. Configure the target group's health check to use port 8443, and ensure the EC2 instances' security group allows inbound traffic from the ALB security group on port 8443.Answer
  3. C
    Modify the target group's health check to query the default HTTP port 80 to minimize processing overhead on the application's secure port.
  4. D
    Configure a stateless Network ACL on the subnet that allows inbound traffic on port 443 and blocks outbound ephemeral port traffic to secure the return path.
  5. E
    Establish an Amazon Route 53 latency routing policy pointing directly to the EC2 instances' public IP addresses to bypass the ALB during periods of high latency.

Answer

The correct actions are to update the health check type of the Auto Scaling group from EC2 to ELB, configure the target group's health check to use port 8443, and ensure the EC2 instances' security group allows inbound traffic from the ALB security group on port 8443.
To ensure that unhealthy application instances are replaced, the Auto Scaling group's health check type must be updated from EC2 to ELB so that target group health status changes trigger auto-replacement. Additionally, because the application runs on custom port 8443, the target group's health check must be explicitly set to port 8443, and the security group of the EC2 instances must allow inbound traffic from the ALB security group on port 8443.

Step-by-Step Solution

1
Analyze the Auto Scaling group health check settings.
Identify that EC2 health checks only monitor the hardware/hypervisor level, meaning application failures are ignored. Setting the ASG health check type to ELB aligns instance replacement with the ALB's status.
This guarantees that instances failing application-level checks are automatically terminated and replaced by the Auto Scaling group.
2
Verify communication paths and ports between the ALB and EC2 instances.
Confirm that the application listens on custom port 8443, meaning target group health checks must query 8443, and security groups must permit inbound traffic on port 8443 from the ALB security group.
This establishes a valid connection path for the ALB health checks, preventing newly launched healthy instances from being flagged as unhealthy.

Key Concept

Auto Scaling health check configurations and load balancer target group routing over custom ports.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic