Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a REST API on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The API service is configured to bind and listen on custom TCP port 5001. The EC2 instances are deployed in private subnets, and their security group permits inbound traffic on port 5001 from the ALB's security group. After a scale-out event, the newly launched instances are repeatedly marked as unhealthy by the ALB target group and are subsequently terminated by the ASG. An investigation reveals that the ALB target group health check is set to the default port, and the private subnet Network ACLs only have explicit rules allowing inbound TCP port 5001 and outbound TCP port 5001. Which two configuration changes must the solutions architect implement to resolve the health check failures and ensure the instances remain in service? (Select two.)

  1. Modify the target group's health check port setting to use port 5001.Answer
  2. Add an outbound rule to the private subnet Network ACL to allow traffic to ephemeral ports (1024−655351024-65535).Answer
  3. C
    Add an inbound rule to the EC2 instance security group to allow traffic on port 80 from the ALB security group.
  4. D
    Change the Auto Scaling group health check type from ELB to EC2.
  5. E
    Configure an Amazon Route 53 latency routing policy to route health check traffic directly to the private IP addresses of the EC2 instances.

Answer

Modify the target group's health check port setting to use port 5001, and add an outbound rule to the private subnet Network ACL to allow traffic to ephemeral ports (1024−655351024-65535).
To resolve the issue, the Solutions Architect must address two distinct configuration gaps. First, the Application Load Balancer target group must be modified to perform health checks on the custom port (5001) instead of the default port (80), ensuring it aligns with the API application port. Second, because Network ACLs are stateless, return traffic from the instances to the ALB must be explicitly allowed. Since the ALB initiates connections to the instances, the response traffic is sent back to the ALB's ephemeral client ports, requiring an outbound Network ACL rule to allow the ephemeral port range (1024−655351024-65535).

Step-by-Step Solution

1
Identify the cause of target group health check failure.
The target group defaults to port 80 for health checks, whereas the API listens on port 5001. Modifying the target group's health check configuration to target port 5001 is required.
Health checks must target the port where the application actually listens, otherwise the load balancer will receive connection timeouts or connection refused errors.
2
Analyze network traffic flow through the subnet Network ACLs.
The Network ACL currently only allows outbound traffic on TCP port 5001. Because Network ACLs are stateless, the return traffic from the instances back to the load balancer (which uses ephemeral ports 1024−655351024-65535) is blocked.
To allow communication, the Network ACL must allow inbound request traffic on port 5001 and outbound return traffic on the ephemeral port range.

Key Concept

ELB health checks require target group configuration alignment with application ports, and stateless network components like Network ACLs require explicit configuration of return traffic to ephemeral ports.
Estimated Time:2m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic