Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a customer-facing web application on Amazon EC2 instances managed by an Auto Scaling group (ASG). The instances are registered with a target group of an Application Load Balancer (ALB). The web application serves user requests on HTTP port 80. However, the application's health status service runs on a dedicated management agent listening on TCP port 8080. The target group health check is configured to query port 8080. Currently, the security group for the EC2 instances allows inbound HTTP traffic on port 80 from the ALB security group. The ALB console reports all EC2 instances as unhealthy, and users are receiving 502 Bad Gateway errors.

Which action should the Solutions Architect take to resolve the issue?

  1. Modify the security group of the EC2 instances to allow inbound traffic on TCP port 8080 from the security group of the ALB.Answer
  2. B
    Modify the subnet Network ACL to allow inbound traffic on port 8080, as security groups are stateless and cannot track the return traffic for the health checks.
  3. C
    Change the target group health check port setting to 'traffic-port' so that the health check automatically queries port 80.
  4. D
    Configure an Amazon Route 53 latency routing policy to route client traffic directly to the elastic network interfaces (ENIs) of the EC2 instances.

Answer

Modify the security group of the EC2 instances to allow inbound traffic on TCP port 8080 from the security group of the ALB.
The correct action is to modify the security group of the EC2 instances to allow inbound traffic on TCP port 8080 from the security group of the ALB. Since the target group health check is configured to query port 8080 but the EC2 instances' security group only allows inbound traffic on port 80, the ALB's health check requests are blocked. Enabling port 8080 inbound allows the ALB to reach the health status service, marking the instances as healthy and resolving the service outage.

Step-by-Step Solution

1
Analyze the ports used for application traffic and health checks.
User traffic uses port 80, but health checks use port 8080.
This establishes that two separate ports must be accessible by the Application Load Balancer.
2
Check the security group rules on the target EC2 instances.
Only port 80 is allowed from the ALB's security group; port 8080 is blocked.
This explains why the ALB is reporting the instances as unhealthy despite the application running correctly.
3
Authorize inbound traffic on port 8080 from the ALB security group to the EC2 instances.
The ALB can now successfully perform health checks, marking the instances as healthy and resuming normal traffic routing.
This resolves the network path blockage specifically for the health check endpoint.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) Health Check and Security Group Integration
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic