Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

A gaming company runs a matchmaking service on Amazon EC2 instances within an Auto Scaling group (ASG). The instances are located in a private subnet and registered with an Application Load Balancer (ALB) target group. The matchmaking service is configured to listen on TCP port 7000. The target group is configured to route traffic to port 7000. Currently, all EC2 instances are marked as unhealthy by the ALB.

The security group for the ALB allows inbound HTTPS traffic from 0.0.0.0/0 and all outbound traffic. The security group for the EC2 instances allows inbound TCP traffic on port 7000 from the ALB's security group. The Network ACL (NACL) for the private subnet has been configured to allow inbound traffic on port 7000 and outbound traffic on port 7000.

Which two changes should the solutions architect make to resolve this issue and allow the instances to register as healthy? (Select two.)

  1. Modify the target group's health check settings to query port 7000 rather than the default port.Answer
  2. Update the outbound rules of the private subnet's network access control list (NACL) to allow TCP traffic to ephemeral ports (1024-65535).Answer
  3. C
    Add an outbound rule to the EC2 instances' security group allowing TCP traffic to the Application Load Balancer's security group on port 7000 to permit response packets.
  4. D
    Configure the target group health check protocol to use HTTPS on the default port to secure the transmission of health check probes.
  5. E
    Set up an Amazon Route 53 Latency routing policy pointing to the Application Load Balancer to dynamically route health check traffic away from the private subnet.

Answer

The solutions architect should modify the target group's health check settings to query port 7000 rather than the default port, and update the outbound rules of the private subnet's network access control list (NACL) to allow TCP traffic to ephemeral ports (1024-65535).
The correct options modify the target group health check port to query the custom service port (port 7000) and open the outbound network ACL to allow return traffic on ephemeral ports (1024-65535). Since target groups default to port 80 for health checks, the mismatch must be corrected. Additionally, because network ACLs are stateless, return packets from port 7000 to the load balancer's ephemeral ports must be permitted explicitly.

Step-by-Step Solution

1
Analyze the target group health check behavior.
By default, an Elastic Load Balancing target group performs health checks using the HTTP protocol on the default port (port 80). Since the EC2 instances are hosting the matchmaking service on port 7000 and their security group only allows inbound traffic on port 7000, any checks to port 80 will fail.
Correcting the target group health check port configuration is necessary to ensure the load balancer probes the active port of the application.
2
Evaluate the network access control list (NACL) configuration.
Network ACLs are stateless. While the inbound NACL allows incoming connections to port 7000, the outbound NACL restricts response traffic to only port 7000. When the Application Load Balancer initiates a connection, it uses an ephemeral source port (1024-65535). The EC2 instances attempt to send response packets to this ephemeral port, but the outbound NACL blocks them.
Allowing outbound TCP traffic to ephemeral ports (1024-65535) is required in the private subnet's NACL to permit successful return communications.

Key Concept

Auto Scaling and Elastic Load Balancing target group health check configuration, and security group/network ACL interactions.
Estimated Time:2m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic