Examkin

Question

Difficulty: EasyAuto Scaling and Elastic Load Balancing (ELB)

A solutions architect has configured an Application Load Balancer (ALB) to distribute traffic to a fleet of Amazon EC2 instances. The web application runs on port 80 on the EC2 instances. The security group associated with the EC2 instances is configured to allow inbound traffic on port 80 from the ALB security group. However, the ALB is marking all EC2 instances as unhealthy. Which of the following is the most likely cause of this issue?

  1. The Network ACL associated with the EC2 instance subnets is blocking the traffic.Answer
  2. B
    The target group health check port is configured to query port 80, creating a mismatch with the application port.
  3. C
    The stateful security group on the EC2 instances is blocking the outbound health check response because there is no rule allowing outbound traffic on ephemeral ports.
  4. D
    A Route 53 latency routing policy is misconfigured, preventing the Application Load Balancer from resolving the domain name of the EC2 instances.

Answer

The Network ACL associated with the EC2 instance subnets is blocking the traffic.
The Network ACL associated with the EC2 instance subnets is blocking the traffic. Because Network ACLs are stateless, they evaluate inbound and outbound traffic independently. Even if a stateful security group allows the inbound health check, a stateless Network ACL that does not allow inbound traffic on port 80 or outbound return traffic on ephemeral ports (typically 1024-65535) will block the health check requests, causing the Application Load Balancer to mark the instances as unhealthy.

Step-by-Step Solution

1
Analyze the stateful vs. stateless nature of the network components.
Security groups are stateful, meaning return traffic is allowed automatically. Network ACLs are stateless, meaning return traffic must be explicitly allowed.
This helps identify why traffic might be blocked outbound even if inbound security groups are correctly configured.
2
Evaluate the health check port configuration.
The application listens on port 80, and the health check queries port 80. This is a correct match, ruling out port mismatch issues.
Verifying that the target group configuration aligns with the application port rules out target group health check port mismatches.
3
Determine if DNS routing affects internal load balancer health checks.
Route 53 latency routing controls client-to-ALB routing, not ALB-to-EC2 target communication.
This rules out DNS routing policies as a cause of internal target health check failures.

Key Concept

Stateless Network ACLs vs. Stateful Security Groups in ELB Health Checks
Estimated Time:50s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic