Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A financial firm is deploying a web application on Amazon EC2 instances in private subnets. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application is configured to listen on port 8080. After deployment, the ALB is marking all registered EC2 instances as unhealthy. The solutions architect must resolve the health check failures and ensure the architecture is secure and resilient. Which combination of actions should the solutions architect take to resolve this issue? (Select two.)

  1. Update the ALB target group health check settings to explicitly use port 8080.Answer
  2. Configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.Answer
  3. C
    Modify the target group to perform health checks on port 80, expecting the operating system to automatically forward the probes to port 8080.
  4. D
    Change the Network ACL of the private subnet to stateful mode to automatically permit ephemeral port return traffic for the health checks.
  5. E
    Set up an Amazon Route 53 Latency routing policy targeting the individual private IP addresses of the EC2 instances to bypass the ALB's health checks.

Answer

Update the ALB target group health check settings to explicitly use port 8080, and configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.
To resolve the health check issues, the target group's health check configuration must be modified to query port 8080 where the application is listening, and the EC2 security group must allow inbound traffic on port 8080 from the ALB security group to allow the probes to succeed.

Step-by-Step Solution

1
Analyze the service configuration and identify the application port.
The application listens on port 8080, which is different from the default port 80.
By default, an Elastic Load Balancing target group performs health checks on the default port of the target group. If the target group defaults to port 80 but the application listens on port 8080, health checks will fail.
2
Ensure network connectivity between the Application Load Balancer and the EC2 instances.
The EC2 instances' security group must permit inbound TCP traffic on port 8080 from the ALB's security group.
Security groups are stateful firewalls. Allowing inbound traffic on the custom port from the load balancer security group allows the health check requests (and client traffic) to reach the instances.

Key Concept

ELB health check configuration and target group security integration
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic