Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

An organization has migrated a legacy internal API to run on Amazon EC2 instances in an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The API service is bound to TCP port 5050 on the instances. After launching the new instances, the ALB reports all targets as unhealthy with a status of 502 Bad Gateway for client requests. The security group associated with the ALB allows traffic on port 443 from client networks. The instances are deployed in private subnets. Which configuration adjustments are required to restore service health and enable successful load balancing? (Select two.)

  1. Configure the security group of the EC2 instances to permit inbound TCP port 5050 traffic from the security group of the Application Load Balancer.Answer
  2. Update the ALB's target group settings to register targets on port 5050 and configure health checks to query the traffic port or port 5050.Answer
  3. C
    Adjust the health check path in the target group to point to the default port 80 so that health monitoring is isolated from custom application ports.
  4. D
    Add a stateless rule to the Network Access Control List (Network ACL) of the instance subnets that redirects inbound TCP port 80 traffic to TCP port 5050.
  5. E
    Implement an Amazon Route 53 latency routing policy that redirects traffic directly to the individual EC2 instance IP addresses when the ALB health checks fail.

Answer

Configure the security group of the EC2 instances to allow inbound traffic on TCP port 5050 from the ALB's security group, and update the ALB's target group settings to register targets on port 5050 and configure health checks to query port 5050.
To resolve the 502 Bad Gateway errors, the Application Load Balancer must be able to successfully connect to the EC2 instances on their active service port. This requires two configurations: first, updating the target group to send both application traffic and health checks to port 5050; second, modifying the security group of the EC2 instances to allow inbound TCP traffic on port 5050 from the ALB's security group.

Step-by-Step Solution

1
Ensure target group routing matches the application port
The target group is updated to register EC2 instances on port 5050, and the health check configuration is set to use the traffic port (5050) so that the ALB checks the actual service.
Since the API runs on port 5050, checking default port 80 will fail as no listener exists there.
2
Configure instance-level security groups to allow traffic from the load balancer
Inbound TCP port 5050 is allowed on the instances' security group, with the source set to the security group of the ALB.
The load balancer needs network-level access to forward client requests and health check probes to the instances on the application port.

Key Concept

Configuring target group port registration, health checks, and security group rules for custom ports behind an Application Load Balancer.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic