Examkin

Question

Difficulty: Very hardElastic Load Balancing Health Checks and Troubleshooting

A company runs a web application on Amazon EC2 instances inside a private subnet. The instances are registered to a target group of an Application Load Balancer (ALB) located in a public subnet. The application is configured to run on port 8080, and the target group's health check is configured to use the default settings (HTTP on traffic-port at path '/'). Recently, the Security team implemented a new custom Network Access Control List (NACL) on the private subnet with an inbound rule allowing TCP port 8080 from the public subnet CIDR, and an outbound rule allowing TCP port 8080 to the public subnet CIDR. Additionally, the application was updated to redirect all unauthenticated requests to '/login' via an HTTP 302 response code. Following these changes, the ALB reports all EC2 instances as unhealthy. To resolve this issue and restore the healthy status of the targets, which set of actions must a SysOps Administrator take?

  1. A
    Update the target group health check matcher to accept HTTP 302, and modify the private subnet's outbound network ACL to allow TCP traffic on port 8080 to the public subnet CIDR.
  2. B
    Modify the target group's health check port to port 80, configure the EC2 instances' web server to listen on port 80 for health checks, and add a rule to the private subnet's inbound network ACL to allow TCP traffic on port 80.
  3. Configure a dedicated, unauthenticated health check endpoint on the application that returns HTTP 200, update the target group health check path to point to this endpoint, and modify the private subnet's outbound network ACL to allow TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR.Answer
  4. D
    Change the Route 53 routing policy for the primary domain name from failover to weighted, set the primary ALB's weight to 0, and configure the target group health check path to use HTTPS on port 443.

Answer

Configure a dedicated, unauthenticated health check endpoint on the application that returns HTTP 200, update the target group health check path to point to this endpoint, and modify the private subnet's outbound network ACL to allow TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR.
Configuring a dedicated, unauthenticated endpoint that returns HTTP 200 and setting the target group to health check this endpoint resolves the response code mismatch caused by the HTTP 302 redirect to the login page. Furthermore, because Network Access Control Lists (NACLs) are stateless, they require return traffic to be explicitly allowed. Since the Application Load Balancer initiates health check connections using ephemeral ports, the private subnet's outbound NACL must allow traffic on ports 1024-65535 to the public subnet CIDR to allow response packets to reach the load balancer.

Step-by-Step Solution

1
Diagnose the application-level health check failure caused by the redirect.
Identify that the application redirects unauthenticated traffic to '/login' returning an HTTP 302 status code. Since the target group health check defaults to expecting HTTP 200, this results in a response code mismatch.
To pass health checks, the load balancer needs to receive a response code that matches its configured matcher (by default, HTTP 200).
2
Analyze the stateless network ACL rules on the private subnet.
Identify that the outbound NACL rule is configured to only allow port 8080. Since network ACLs are stateless, they must explicitly allow outbound return traffic. When the load balancer initiates a health check, it uses a random ephemeral port (1024-65535) as the source. The response from the EC2 instance is destined for this ephemeral port, which is blocked by the outbound NACL.
Stateless firewalls require explicit rules in both directions; outbound rules must permit return traffic to the ephemeral ports of the client.
3
Implement the resolution steps for both application and network layers.
Create a dedicated, unauthenticated '/healthz' endpoint on the EC2 instances that returns HTTP 200. Configure the target group to use this new path. Then, modify the private subnet's outbound network ACL rule to allow TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR.
This dual-remediation resolves the redirect issue at the application layer and allows the return traffic to flow back to the load balancer at the network layer.

Key Concept

Stateless Network Access Control Lists (NACLs) ephemeral ports and Application Load Balancer health check matcher configuration.
Estimated Time:3m 0s
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic