Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a web application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on custom port 84438443 for HTTPS traffic. The target group is configured to forward traffic to port 84438443. Although the application is running normally and accepting connections locally, the ALB is marking all EC2 instances as unhealthy. The EC2 instance security group allows inbound traffic on port 84438443 from the ALB security group. Which of the following is the most likely cause of this issue?

  1. A
    The security group for the EC2 instances does not have an outbound rule allowing response traffic on port 84438443 to the Application Load Balancer.
  2. B
    The Route 53 latency-based routing policy is failing to route health check traffic to the healthy instances because health checking is disabled in Route 53.
  3. The target group's health check configuration is using the default protocol port of 8080 instead of 84438443 or the 'traffic-port' setting.Answer
  4. D
    The Network ACL associated with the Application Load Balancer subnets does not have an inbound rule allowing return traffic on port 84438443 from the EC2 subnets.

Answer

The target group's health check configuration is using the default protocol port of 8080 instead of 84438443 or the 'traffic-port' setting.
The correct answer states that the target group's health check is misconfigured to use the default protocol port of 8080. In AWS Elastic Load Balancing, target groups default to performing health checks on the protocol's standard port (such as port 8080 for HTTP) unless they are explicitly configured to use a custom port or the 'traffic-port' setting. Since the web application is only listening on port 84438443, health check probes sent to port 8080 fail, leading the ALB to identify the targets as unhealthy.

Step-by-Step Solution

1
Analyze the application port settings and target group settings.
The application listens on port 84438443, the target group forwards traffic to port 84438443, and the EC2 security group allows inbound traffic on port 84438443 from the ALB.
This confirms that the application is reachable on its listening port from the ALB, meaning the issue must be related to health check configurations or misconfigured network filters.
2
Examine target group default behaviors for health checks.
By default, the target group health check uses the default protocol port (8080 for HTTP) unless explicitly configured otherwise.
Since the application only runs on port 84438443, health checks sent to port 8080 will not be answered, causing the ALB to mark the instances as unhealthy.
3
Evaluate network configuration distractors regarding statefulness.
Security groups are stateful, so no outbound rule is needed on the EC2 instances. Network ACLs are stateless, but return traffic from the EC2 targets back to the ALB uses ephemeral ports (10241024-6553565535), not port 84438443.
This rules out security group and Network ACL configuration misconceptions as the root cause of the unhealthy status.

Key Concept

ELB Target Group Health Check Port configuration and its default protocol port behavior.
Estimated Time:1m 30s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic