Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a high-traffic web application on Amazon EC2 instances inside a private subnet. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). After the security team updated the network access control list (Network ACL) of the private subnet to restrict inbound traffic to only port 80, the ALB target group health checks began failing, marking all EC2 instances as unhealthy and resulting in HTTP 502 Bad Gateway errors. The security groups associated with the EC2 instances allow all inbound traffic from the ALB. Which configuration change will resolve this issue and restore application availability?

  1. Add an outbound rule to the private subnet Network ACL allowing TCP traffic to the ALB subnet on ephemeral ports 1024−655351024 - 65535.Answer
  2. B
    Add an outbound rule to the security group associated with the EC2 instances allowing TCP traffic to the ALB on ephemeral ports 1024−655351024 - 65535.
  3. C
    Update the target group health check configuration port from port 80 to use a dynamic ephemeral port in the range 1024−655351024 - 65535.
  4. D
    Configure a Route 53 Latency routing policy to route client requests directly to the EC2 instances' private IP addresses, bypassing the ALB.

Answer

Add an outbound rule to the private subnet Network ACL allowing TCP traffic to the ALB subnet on ephemeral ports 1024−655351024 - 65535.
The correct option is correct because Network ACLs are stateless, meaning that outbound return traffic must be explicitly allowed. When the ALB sends a health check request to the EC2 instances on port 80, the return traffic from the instances back to the ALB is sent on an ephemeral port (1024−655351024 - 65535). Because the Network ACL only has an inbound rule for port 80 and no outbound rule for ephemeral ports, the return traffic is blocked, causing the health checks to fail. Adding an outbound rule for the ephemeral ports resolves the issue.

Step-by-Step Solution

1
Identify the impact of the Network ACL change on the network path between the Application Load Balancer (ALB) and the Amazon EC2 instances.
The Network ACL blocks all outbound return traffic from the EC2 instances to the ALB because Network ACLs are stateless, and only inbound traffic on port 80 was allowed.
Understanding the stateless nature of Network ACLs helps diagnose why healthy instances are marked unhealthy when inbound rules are tightened without considering outbound return paths.
2
Analyze the port requirements for the return traffic from the EC2 instances to the ALB.
Return traffic initiated by an inbound request on port 80 is sent back to the client (ALB) on ephemeral ports, which typically range from 10241024 to 6553565535.
The stateless Network ACL must explicitly permit outbound traffic on the ephemeral port range to allow the HTTP response to reach the ALB.
3
Formulate the correction to the Network ACL configuration.
Add an outbound rule to the private subnet's Network ACL allowing TCP traffic to the ALB's subnet on ports 1024−655351024 - 65535.
This allows the response of the health checks to successfully return to the ALB, allowing the targets to be marked as healthy and restoring service.

Key Concept

Stateless Network ACLs require explicit configuration of outbound return traffic paths, which utilize ephemeral ports.
Estimated Time:2m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic