Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a specialized financial reporting API on Amazon EC2 instances managed by an Auto Scaling group. The API runs on a custom port 8000 and is positioned behind an Application Load Balancer (ALB). The EC2 instances run initialization scripts during startup that typically take 5 minutes to complete before the application can respond to requests. The solutions architect must secure the environment so that the EC2 instances accept traffic only from the ALB, and ensure that newly launched instances are not marked unhealthy and terminated prematurely during their initialization phase.

Which two actions should the solutions architect take to meet these requirements? (Select two.)

  1. Configure the security group associated with the EC2 instances to allow inbound traffic on port 8000 only from the security group of the ALB.Answer
  2. Set the health check grace period on the Auto Scaling group to 360 seconds.Answer
  3. C
    Modify the network ACL of the private subnet to allow inbound traffic on port 8000 and deny all other ports.
  4. D
    Set the target group health check port to port 80 to verify instance reachability before the application starts on port 8000.
  5. E
    Configure an Amazon Route 53 latency routing policy pointing directly to the EC2 instances to distribute the initialization load.

Answer

Configure the security group associated with the EC2 instances to allow inbound traffic on port 8000 only from the security group of the ALB, and set the health check grace period on the Auto Scaling group to 360 seconds.
To secure the instances, the solutions architect must allow inbound traffic on port 8000 in the EC2 security group only from the security group of the ALB. To prevent premature termination of newly launched instances due to the 5-minute initialization period, the health check grace period of the Auto Scaling group must be configured to a duration longer than 300 seconds (e.g., 360 seconds).

Step-by-Step Solution

1
Add a rule to the security group of the EC2 instances to allow TCP traffic on port 8000, setting the source as the security group ID of the Application Load Balancer.
Network access to the backend instances on the application port is locked down to traffic originating from the load balancer.
This implements the security requirement at the instance layer using stateful security groups.
2
Configure the health check grace period parameter on the Auto Scaling group to 360 seconds.
The Auto Scaling group waits for 360 seconds (6 minutes) before performing health checks on newly launched instances.
This accommodates the 5-minute (300-second) boot-up delay from initialization scripts, preventing premature instance termination.

Key Concept

Securing load-balanced target groups using security groups and configuring health check grace periods to allow for instance initialization.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic