Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

A retail company hosts its core ordering application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application runs on a custom port 8085. The ALB listener is configured to accept HTTPS traffic on port 443 and forward it to a target group containing the EC2 instances on port 8085. To meet strict security requirements, the EC2 security group is restricted to allow inbound TCP traffic on port 8085 only from the ALB security group. However, after a new deployment, the target group health checks fail, and the ASG repeatedly terminates and replaces the instances.

Which action should the Solutions Architect take to resolve the issue and ensure the instances pass health checks while maintaining the current security posture?

  1. Update the target group health check configuration to use the traffic-port (port 8085) for health checks.Answer
  2. B
    Modify the target group health check to query HTTP port 80, and add an inbound rule to the EC2 instances' security group allowing TCP port 80 from the ALB security group.
  3. C
    Add a stateless inbound rule to the subnet's network ACL (NACL) allowing TCP port 80 traffic from the ALB subnets to pass health check packets.
  4. D
    Create an Amazon Route 53 latency routing policy pointing to the individual EC2 instances, and associate a Route 53 HTTP health check to manage instance routing directly.

Answer

Update the target group health check configuration to use the traffic-port (port 8085) for health checks.
The application runs on port 8085, and the EC2 instances' security group only allows inbound traffic on port 8085 from the Application Load Balancer (ALB). By default, target group health checks are sent to the default port (typically port 80) unless customized. Updating the target group health check configuration to use the traffic-port (port 8085) ensures that health check requests are sent to the port where the application is listening and where traffic is permitted by the security group.

Step-by-Step Solution

1
Analyze the port mappings and security group rules.
The application listens on port 8085. The security group on the EC2 instances restricts inbound traffic to port 8085 from the Application Load Balancer (ALB) security group.
This establishes that port 8085 is the only valid port for application traffic and health checks under the current security posture.
2
Identify why the target group health checks are failing.
By default, target groups perform health checks on the default port (typically port 80) unless overridden. Since port 80 is blocked by the security group and has no service listening, health checks fail.
Pinpointing the port mismatch clarifies why the load balancer marks healthy instances as unhealthy.
3
Select the resolution that resolves the port mismatch without introducing security vulnerabilities.
Configure the target group to perform health checks on the traffic-port (port 8085).
This ensures the load balancer queries the correct active application port, aligned with existing security group rules.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) Target Group Health Check Port configuration
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic