Examkin

Question

Difficulty: EasyAuto Scaling and Elastic Load Balancing (ELB)

A solutions architect is deploying a web application on Amazon EC2 instances managed by an Auto Scaling group. The application runs on port 8080 and is registered with an Application Load Balancer (ALB) target group. The load balancer marks all EC2 instances as unhealthy, even though the application is running successfully on the instances. The security groups are already correctly configured to allow traffic on port 8080. Which two configurations should the solutions architect verify to resolve this health check issue? (Select two.)

  1. Ensure that the target group health check port is explicitly configured to use port 8080 or the traffic port instead of defaulting to port 80.Answer
  2. Ensure that the stateless network access control list (network ACL) associated with the subnets allows outbound traffic on the ephemeral port range to permit health check responses.Answer
  3. C
    Add an outbound rule to the security group of the EC2 instances to allow return traffic to the ALB security group on port 8080.
  4. D
    Change the health check port to port 80 in the target group settings because Application Load Balancers do not support custom ports for health checks.
  5. E
    Configure an Amazon Route 53 latency routing policy with a health check pointing directly to the EC2 instances to bypass the ALB target group.

Answer

Verify that the target group health check port is explicitly configured to use port 8080 or the traffic port, and check that the stateless network ACLs allow outbound traffic on the ephemeral port range.
The correct configurations involve correcting the target group health check port and ensuring that stateless network ACLs allow the return traffic. By default, target group health checks may query port 80, but since the application runs on port 8080, the health check port must be set to port 8080 or configured as the 'traffic-port'. Additionally, since network ACLs are stateless, they require explicit outbound rules for the ephemeral port range to allow return traffic from the EC2 instances back to the load balancer.

Step-by-Step Solution

1
Analyze the load balancer health check configuration and compare it to the port where the application is listening.
The application is running on port 8080, but default health checks might query port 80. The target group must be updated to query port 8080 or the traffic port.
Health checks fail if they query a port where no service is listening.
2
Examine the subnet-level network access control lists (network ACLs) for traffic restrictions.
Since network ACLs are stateless, verify that outbound rules permit traffic to the ephemeral ports (1024-65535) back to the load balancer.
Even if inbound traffic is allowed, stateless network ACLs will block the return health check responses if ephemeral outbound ports are not open.

Key Concept

Auto Scaling and Elastic Load Balancing health checks rely on matching port configurations and stateful/stateless firewall rules (security groups and network ACLs) to function correctly.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic