Examkin

Question

Difficulty: HardAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a specialized analytics platform on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens for HTTPS traffic on TCP port 8443. To monitor the application's internal status, a custom telemetry agent runs on the instances, listening on TCP port 9090. The Solutions Architect configures the ALB target group's health check settings to use TCP port 9090. The security group of the EC2 instances is configured to allow inbound TCP traffic on port 8443 from the ALB's security group. All outbound traffic from the instances is allowed. Despite the instances functioning correctly, the ALB marks all targets as unhealthy, and the ASG is repeatedly terminating and replacing the instances. Which action should the Solutions Architect take to resolve this issue?

  1. Update the EC2 instances' security group to allow inbound TCP traffic on port 9090 from the ALB's security group.Answer
  2. B
    Change the target group's health check configuration to use the 'traffic port' setting, since Application Load Balancers can only perform health checks on the port where application traffic is received.
  3. C
    Add an outbound rule to the EC2 instances' security group allowing TCP traffic on port 9090 to the ALB's security group, as security groups are stateless and require explicit egress rules.
  4. D
    Create an Amazon Route 53 latency routing policy targeting the EC2 instances' public IP addresses on port 9090 to handle health checks and bypass the Application Load Balancer's target group health checks.

Answer

Update the EC2 instances' security group to allow inbound TCP traffic on port 9090 from the ALB's security group.
The correct option is to update the security group of the EC2 instances to allow inbound TCP traffic on port 9090 from the Application Load Balancer's security group. Since the load balancer is configured to perform health checks on port 9090, but the instances only allow traffic on port 8443, the health check requests are blocked at the instance level. Allowing inbound traffic on port 9090 resolves the issue, and because security groups are stateful, the return traffic is automatically permitted.

Step-by-Step Solution

1
Analyze the communication flow for ALB health checks.
The Application Load Balancer originates health check probes targeting TCP port 9090 on the EC2 instances.
The target group has been explicitly configured to perform health checks on TCP port 9090 instead of the standard application port.
2
Examine the security group configuration of the EC2 instances.
The security group only allows inbound traffic on port 8443 from the ALB security group, thereby blocking the health check probes on port 9090.
To resolve the unhealthy target state, the security group must permit inbound traffic on port 9090 from the ALB.
3
Evaluate the statefulness of security groups.
No outbound security group rule modification is needed because security groups are stateful and allow return traffic automatically.
Modifying only the inbound rule is sufficient and maintains the principle of least privilege.

Key Concept

ELB health checks can target a custom port, which must be explicitly allowed by the EC2 instance's security group.
Estimated Time:2m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic