Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a web service on Amazon EC2 instances in private subnets. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The web service is configured to listen on TCP port 84438443. The ALB target group has its target port set to 84438443, and the EC2 instances' security group allows inbound traffic on port 84438443 from the ALB's security group. After a recent deployment, the ALB marks all instances in the target group as unhealthy, and clients receive HTTP 502502 (Bad Gateway) errors, even though the application logs confirm that the service is running and healthy on the instances. What is the most likely cause of this issue?

  1. A
    The Network ACL of the private subnet lacks an inbound rule that allows traffic from the security group of the Application Load Balancer.
  2. B
    The security group associated with the EC2 instances is stateless, requiring an explicit outbound rule to allow return traffic back to the Application Load Balancer.
  3. The target group is configured to perform health checks using the default port (HTTP port 8080) rather than port 84438443 where the application is listening.Answer
  4. D
    Amazon Route 5353 latency routing is misconfigured to route traffic directly to the private IP addresses of the EC2 instances, bypassing the Application Load Balancer.

Answer

The target group is configured to perform health checks using the default port (HTTP port 8080) rather than port 84438443 where the application is listening.
The Application Load Balancer determines target health using the configured health check port. If this is left as the default (typically port 8080) rather than the application's actual listening port (84438443), the health check probes will fail, leading the load balancer to mark all instances as unhealthy and return HTTP 502502 Bad Gateway errors.

Step-by-Step Solution

1
Analyze the load balancer behavior and the HTTP 502502 error.
The HTTP 502502 error indicates that the Application Load Balancer is unable to establish a connection with any healthy target instances.
When all backend instances are marked as unhealthy, the Application Load Balancer cannot forward traffic and returns a Bad Gateway error.
2
Examine the application port configuration versus the health check configuration.
The application listens on port 84438443, and the target group routes traffic to port 84438443, but the health check port is not explicitly specified.
If not specified, the target group's health check defaults to the protocol's default port (8080 for HTTP), which has nothing listening on it.
3
Verify if other network access configurations are correct.
The EC2 security group allows traffic on port 84438443 from the ALB, confirming that standard traffic flow is permitted.
This rules out security groups blocking application traffic on port 84438443, pointing to the health check configuration mismatch as the root cause.

Key Concept

Target Group Health Checks
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic