Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts an internal inventory management service on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application serves client API traffic on HTTPS port 443. A custom health monitoring agent runs on port 8080 on each EC2 instance. The target group is configured to route client traffic to port 443 and perform health checks on port 8080. The security group of the EC2 instances allows inbound traffic on port 443 from the security group of the ALB. However, the EC2 instances are continually marked as unhealthy by the ALB, and the ASG is repeatedly terminating and replacing them. Which action will resolve this issue and allow the instances to pass the health checks?

  1. Update the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.Answer
  2. B
    Modify the subnet's Network ACL to allow inbound traffic on port 8080, and rely on the stateful nature of security groups to automatically allow the return traffic.
  3. C
    Configure the target group health check to use the default traffic-port (port 443), expecting the Application Load Balancer to automatically forward the health checks to the health agent on port 8080.
  4. D
    Configure an Amazon Route 53 latency routing policy with active health checks pointing directly to the EC2 instances' Elastic IP addresses to bypass the Application Load Balancer.

Answer

Update the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.
The correct action is to update the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB. Because the Application Load Balancer is configured to perform health checks on a custom port (8080), the security group of the backend EC2 instances must explicitly permit this traffic. If only port 443 is open, the ALB's health check requests to port 8080 will be dropped, marking the instances as unhealthy and prompting the Auto Scaling group to terminate and replace them.

Step-by-Step Solution

1
Identify the ports used for application traffic and health check traffic.
Application traffic uses HTTPS port 443, while health checks use port 8080.
Understanding the separation of traffic and health ports is critical for configuring access control.
2
Review the security group rules applied to the EC2 instances.
The current security group only allows inbound traffic on port 443 from the ALB.
Since the ALB sends health check requests on port 8080, these requests are blocked by the security group, causing health check failures.
3
Add an inbound rule to the EC2 instances' security group.
Inbound TCP traffic on port 8080 is now permitted from the security group of the ALB.
This allows the ALB health check requests to reach the health monitoring agent on the instances, resolving the unhealthy state.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) health check routing and security group configuration.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic