Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

An enterprise runs a critical API workload on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ALB is configured with an HTTPS listener forwarding traffic to a target group on port 84438443. The application on the EC2 instances processes user traffic on port 84438443. However, the application's internal health status is exposed only via a lightweight management server running on port 80808080 on the same instances. Currently, the EC2 security group allows inbound TCP traffic on port 84438443 from the ALB security group. The target group health check is set to its default configuration, and the instances are consistently marked as unhealthy by the ALB, causing the ASG to terminate and relaunch them. Which configuration change should a solutions architect implement to resolve the health check failures while maintaining the principle of least privilege?

  1. Modify the target group health check configuration to override the port to 8080, and add a rule to the EC2 security group allowing inbound TCP traffic on port 8080 from the ALB security group.Answer
  2. B
    Update the target group health check path to point to http://localhost:8080/health while keeping the health check port set to the default traffic-port setting.
  3. C
    Update the target group health check port to 8080, and modify the subnet Network ACL (NACL) to allow inbound TCP traffic on port 8080 from the ALB subnets.
  4. D
    Change the Route 53 DNS record to use a Latency routing policy targeting the individual public IP addresses of the EC2 instances, bypassing the ALB.

Answer

Modify the target group health check configuration to override the port to 8080, and add a rule to the EC2 security group allowing inbound TCP traffic on port 8080 from the ALB security group.
The correct option addresses both the network connectivity and the application configuration. By overriding the target group health check port to 8080, the Application Load Balancer (ALB) is directed to send health probes to the correct port where the application health endpoint resides. Furthermore, adding an inbound rule to the EC2 security group for port 8080 allows the ALB's stateful health probes to successfully reach the instances, resolving the health check failures under the principle of least privilege.

Step-by-Step Solution

1
Analyze the target group port mapping.
The target group uses port 8443 by default for traffic and health checks ('traffic-port').
Identify why the ALB is sending health check requests to port 8443 instead of the management port 8080.
2
Configure the health check port override.
Modify the target group settings to explicitly perform health checks on port 8080.
Ensure that the load balancer queries the correct port where the application's health status is exposed.
3
Update security group rules.
Add an inbound rule to the EC2 instance security group allowing TCP port 8080 traffic from the ALB security group.
Since security groups are stateful and evaluate traffic at the instance level, the ALB's health check queries on port 8080 will be blocked unless explicitly permitted by the security group.

Key Concept

ELB Target Group Health Check Port Configuration and Security Group Integration
Estimated Time:2m 30s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic