Examkin

Question of the Day

A fresh AWS Certified Solutions Architect - Associate question every day — build the habit.

An organization is launching an internal analytics dashboard on Amazon EC2 instances managed by an Auto Scaling group. The dashboard application is configured to run on TCP port 8080. The instances are deployed in private subnets behind an Application Load Balancer (ALB). The solutions architect has associated a custom Network ACL (NACL) with the private subnets. Although security groups are configured to allow port 8080 traffic between the ALB and the EC2 instances, the ALB target group reports all instances as unhealthy. Local testing confirms the dashboard service is responding normally on port 8080.

Which combination of steps must the solutions architect take to resolve this issue and allow the health checks to pass? (Select two.)

  1. Modify the target group's health check configuration to query port 8080 instead of the default port 80.Answer
  2. Add an outbound rule to the private subnet's custom Network ACL to allow TCP traffic to the load balancer subnet on ephemeral ports (1024-65535).Answer
  3. C
    Add an outbound rule to the EC2 instances' security group to allow traffic on ephemeral ports (1024-65535) to the load balancer security group.
  4. D
    Create an Amazon Route 53 latency routing policy to route traffic directly to the private IP addresses of the EC2 instances when the load balancer health checks fail.
  5. E
    Change the target group port configuration to port 80 and use an Application Load Balancer listener rule to translate traffic to port 8080.

Answer

To resolve the unhealthy target status, the solutions architect must configure the target group health check port to 8080 and ensure the stateless Network ACL allows outbound ephemeral return traffic from the EC2 subnet to the Application Load Balancer.
The Application Load Balancer target group needs to be configured with the correct health check port (port 8080) to match the port where the dashboard application is running. By default, the health check may query port 80, which fails because the application is bound to port 8080. Additionally, since a custom Network ACL (NACL) is applied to the private subnets, outbound rules must be configured to allow return traffic. Because NACLs are stateless, they do not automatically track connections, and return traffic from the EC2 instances to the ALB must be explicitly allowed on ephemeral ports (1024-65535).

Step-by-Step Solution

1
Identify the port mismatch between the application and the load balancer health check configuration.
The health check port must be updated from the default (port 80) to port 8080.
The dashboard application is bound to port 8080; querying port 80 will fail as nothing is listening on it.
2
Analyze the custom Network ACL (NACL) configuration for the private subnets.
Add an outbound rule allowing TCP traffic on ephemeral ports (1024-65535) to the load balancer subnet.
Network ACLs are stateless, meaning return traffic from the EC2 instances to the load balancer must be explicitly permitted.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) configuration with stateless Network ACLs and custom ports
See full question & explanationTake a full practice test