Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that is serving a web application. The application runs on Amazon EC2 instances in private subnets and listens on port 8081. The target group is configured to route traffic to the instances on port 8081. However, the ALB is returning HTTP 503 Service Unavailable errors to clients, and all instances in the target group are reported as unhealthy with the status description 'Healthcheck.Failed'. The administrator verifies that the target group's health check is configured to perform HTTP checks on port 80. Which of the following actions should the administrator take to resolve this issue and restore the health of the targets? (Select TWO.)

  1. Update the security group of the EC2 instances to allow inbound TCP traffic on port 8081 from the security group associated with the ALB.Answer
  2. Modify the target group health check configuration to use port 8081 instead of port 80.Answer
  3. C
    Update the security group of the ALB to allow inbound TCP traffic on port 80 from the EC2 instances' security group.
  4. D
    Modify the subnet's outbound network ACL (NACL) rules to allow traffic on port 80 to the Internet Gateway.
  5. E
    Create an active-passive Amazon Route 53 DNS failover routing policy to route traffic directly to the EC2 instances.

Answer

Update the security group of the EC2 instances to allow inbound TCP traffic on port 8081 from the security group associated with the ALB, and modify the target group health check configuration to use port 8081 instead of port 80.
To resolve the health check failure, the health check port must be aligned with the application port, and the firewall rules must permit this path. Specifically, the target group's health check configuration must be modified to target port 8081 where the application is listening. Concurrently, the security group of the EC2 instances must allow inbound TCP traffic on port 8081 from the ALB's security group so that the load balancer's health check probes can successfully reach the instances.

Step-by-Step Solution

1
Identify the port on which the web application is listening on the EC2 instances.
The application listens on port 8081.
Health check requests must be sent to the port where the backend service is actively running.
2
Compare the application port with the configured health check port in the target group settings.
The health check is configured to check port 80, which is incorrect.
No service is listening on port 80, causing the health check requests to fail.
3
Configure the security groups to permit communication between the ALB and the EC2 instances.
The EC2 instances' security group must allow inbound TCP traffic on port 8081 originating from the security group of the ALB.
Security groups are stateful and must explicitly allow inbound traffic from the load balancer on the application's port.

Key Concept

Elastic Load Balancing Health Check Port and Security Group Alignment
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic