Examkin

Question

Difficulty: MediumAuto Scaling and Elastic Load Balancing (ELB)

A financial company hosts a reporting application on a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG). The instances run in private subnets and are registered with an Application Load Balancer (ALB). The application receives traffic on port 8000, but its health check endpoint is exposed on administrative port 8081. Currently, the ALB is marking all instances as unhealthy, and the ASG is continuously terminating and replacing them. Which two configurations are required to resolve this issue and allow the ALB to perform health checks successfully? (Select two.)

  1. Configure the health check port in the ALB target group settings to port 8081.Answer
  2. Add a rule to the EC2 instances' security group allowing inbound TCP traffic on port 8081 from the ALB's security group.Answer
  3. C
    Configure an inbound rule in the private subnet's Network ACL to allow TCP traffic on port 8081 from the ALB's security group.
  4. D
    Add an ALB listener on port 8081 that forwards traffic directly to the registered EC2 instances.
  5. E
    Configure a Route 53 latency routing policy with a health check targeting the instances directly on port 8081.

Answer

The target group health check settings must be updated to use port 8081, and the security group of the EC2 instances must be modified to allow inbound TCP traffic on port 8081 from the security group of the Application Load Balancer.
To resolve the issue, the solutions architect must configure the ALB target group's health check port to match the administrative port (8081) where the application is listening for health status checks. Additionally, the security group for the EC2 instances must allow inbound TCP traffic on port 8081 from the security group of the Application Load Balancer, ensuring the health check requests are permitted through the instance's firewall.

Step-by-Step Solution

1
Identify the ports involved in the scenario.
The application receives client traffic on port 8000, while the health check endpoint is on port 8081.
Since these are different, the default behavior of targeting the traffic port (8000) for health checks will fail.
2
Configure the target group to query the custom health check port.
Override the target group health check port setting by specifying port 8081.
This ensures the ALB sends health check requests to the administration port where the health endpoint is running.
3
Configure the host security controls to allow health check traffic.
Allow inbound traffic on port 8081 from the ALB security group in the EC2 instance security group.
Security groups act as a stateful firewall at the instance level and must explicitly permit the health check queries from the load balancer.

Key Concept

Configuring Application Load Balancer health checks on custom ports requires overriding the health check port in the target group and allowing the traffic through instance-level security groups.
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic