Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

A company is deploying a secure internal microservice on a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The microservice is configured to listen on port 84438443. The target group is configured to route HTTPS traffic to port 84438443 with the health check port set to 'traffic-port'. The EC2 instances are launched in private subnets, while the ALB resides in public subnets. The private subnets are associated with a custom Network ACL (NACL) that permits inbound traffic on port 84438443 from the public subnets and outbound traffic on port 84438443 to the public subnets. The EC2 security group allows inbound traffic on port 84438443 from the ALB security group, and has the default outbound rule allowing all traffic. However, the ALB marks all EC2 instances as unhealthy, and clients receive HTTP 502502 Bad Gateway errors. Which of the following actions should the solutions architect take to resolve the health check issue and restore normal operation?

  1. A
    Modify the security group associated with the EC2 instances to allow outbound traffic to the ALB security group on port 84438443, as security groups are stateless and require explicit rules for return traffic.
  2. B
    Modify the target group's health check configuration to query port 443443 instead of the default 'traffic-port', because Application Load Balancer health checks require standard TLS ports.
  3. Update the custom Network ACL rules on the private subnets to allow outbound traffic on ephemeral ports (10241024-6553565535) to the public subnets.Answer
  4. D
    Configure an Amazon Route 5353 latency routing policy pointing directly to the private IP addresses of the EC2 instances, bypassing the Application Load Balancer to ensure high availability.

Answer

Update the custom Network ACL rules on the private subnets to allow outbound traffic on ephemeral ports (10241024-6553565535) to the public subnets.
The correct option is the one suggesting to update the custom Network ACL rules on the private subnets. Network ACLs are stateless, meaning that outbound return traffic must be explicitly allowed. When the Application Load Balancer sends health check requests to the EC2 instances on port 84438443, the instances respond using ephemeral source ports (10241024-6553565535). Because the outbound NACL rule only allowed traffic on port 84438443, the return traffic was blocked, causing the load balancer to mark the instances as unhealthy. Allowing outbound traffic to ephemeral ports resolves this issue.

Step-by-Step Solution

1
Analyze the statefulness of the security group and Network ACL configuration.
Identify that the security group is stateful and does not block the return path, whereas the Network ACL (NACL) is stateless and requires explicit rules for return traffic.
To pinpoint which security filter is blocking the health check responses from the EC2 instances.
2
Determine the source and destination ports for the load balancer health checks.
The ALB sends health checks to the instances on port 84438443 (destination). The instances reply back to the ALB's ephemeral ports in the range 10241024-6553565535 (destination).
To verify if the return traffic matches the allowed outbound rule of the private subnets' custom NACL.
3
Apply the correction to the stateless Network ACL.
Add an outbound rule allowing TCP traffic in the range 10241024-6553565535 to the public subnets where the ALB is located.
This allows the return traffic from the instances to reach the ALB, allowing the health check to succeed.

Key Concept

Stateless nature of Network ACLs compared to stateful Security Groups in Elastic Load Balancing architectures.
Estimated Time:2m 30s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic