Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts an internal dashboard on Amazon EC2 instances managed by an Auto Scaling group (ASG). The dashboard application runs on custom port 8090. The ASG is registered with a target group behind an Application Load Balancer (ALB). The EC2 instances' security group is configured to allow inbound traffic from the ALB's security group on port 8090. However, the ALB marks all instances as unhealthy and returns a 502 Bad Gateway error to users. Local verification shows that the application is running and responding normally on port 8090 on each instance.

Which of the following actions should a solutions architect take to resolve this issue?

  1. A
    Add an inbound rule to the subnet's network ACL to allow traffic from the security group of the Application Load Balancer on port 8090.
  2. B
    Configure an Amazon Route 53 latency routing policy to route traffic directly to the public IP addresses of the EC2 instances, bypassing the Application Load Balancer.
  3. Configure the target group's health check port to use port 8090 instead of the default port 80.Answer
  4. D
    Add an outbound rule to the security group of the EC2 instances to explicitly allow ephemeral port range traffic to the Application Load Balancer for health check responses.

Answer

Configure the target group's health check port to use port 8090 instead of the default port 80.
The correct action is to configure the target group's health check port to use port 8090 instead of the default port 80. The Application Load Balancer marks the EC2 instances as unhealthy because the health check configuration is querying the default port 80, whereas the application is only listening and responding on the custom port 8090. Updating the health check port ensures the load balancer checks the correct application endpoint.

Step-by-Step Solution

1
Diagnose the source of the 502 Bad Gateway error and unhealthy targets.
The Application Load Balancer (ALB) reports the targets as unhealthy because its health checks are failing. Since the application runs on custom port 8090 but local tests show it is healthy, the ALB is likely querying the wrong port.
By default, target group health checks query the default HTTP port (port 80) unless overridden or configured to use the traffic port.
2
Evaluate the target group configuration parameters.
Configuring the health check port to explicitly use port 8090 (or the traffic port) directs the ALB to query the correct port on which the service is listening.
This aligns the health check destination with the actual application port, allowing the health check requests to succeed.
3
Assess security and routing rules to rule out incorrect configurations.
Security groups are stateful, so outbound rules for return traffic are unnecessary. Network ACLs do not support security group references. Latency-based routing does not fix target group health failures.
Ensures the solution adheres to core AWS networking principles without introducing security group or network ACL misconfigurations.

Key Concept

ELB Health Check Port Configuration and Security Group Statefulness
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic