Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company runs a wellness tracking application. The backend API is hosted on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The API processes requests on TCP port 8443. Currently, clients cannot connect to the backend, and the instances are being marked as unhealthy by the target group, leading to continuous instance replacement by the ASG. The network configuration uses private subnets for the EC2 instances and public subnets for the ALB.

Which two configurations should a solutions architect verify to resolve the health check failures and ensure proper traffic flow? (Select two.)

  1. Ensure that the target group health check port is configured to use port 8443 or the traffic port instead of defaulting to port 80.Answer
  2. Configure the EC2 instance security group to allow inbound traffic on TCP port 8443 from the security group of the Application Load Balancer.Answer
  3. C
    Set the target group health check port to port 80 so that health checks do not consume processing capacity on the application port 8443.
  4. D
    Add an outbound rule to the EC2 instance security group allowing ephemeral port traffic to the Application Load Balancer to permit return packets.
  5. E
    Set up an Amazon Route 53 latency-based routing policy pointing directly to individual EC2 instances to distribute traffic and bypass the Application Load Balancer during high-latency periods.

Answer

Verifying that the target group health check is set to port 8443 or the traffic port, and configuring the EC2 instance security group to allow inbound traffic on port 8443 from the Application Load Balancer security group.
The Application Load Balancer routes traffic to targets based on target group settings. Since the backend service is listening on custom TCP port 8443, the target group health check port must be configured to query port 8443 (or use the traffic port) so that health checks are sent to the correct active port. By default, health checks are sent to port 80, which will fail if no service is listening there. Additionally, because the EC2 instances are in private subnets and receive traffic from the ALB, the security group associated with the EC2 instances must allow inbound traffic on port 8443 from the ALB's security group to permit both user traffic and health check probes.

Step-by-Step Solution

1
Analyze the port configuration of the application service and the load balancer target group.
Identify that the application processes traffic on port 8443, but target group health checks default to port 80.
Health checks sent to a port with no active service will fail, causing the ASG to terminate instances.
2
Examine security group settings between the ALB and the EC2 instances.
Determine that the instances must allow inbound traffic on port 8443 specifically from the ALB security group.
This permits the ALB to perform health check probes and forward application traffic to the backend instances.
3
Validate security group statefulness.
Recognize that return traffic does not require outbound security group rules.
Security groups track connections and state, so return traffic on ephemeral ports is allowed automatically.

Key Concept

Configuring health checks and security groups for Application Load Balancers with custom ports.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic