Examkin

Question

Difficulty: HardElastic Load Balancing Health Checks and Troubleshooting

A SysOps Administrator is troubleshooting an internal Application Load Balancer (ALB) that routes HTTPS traffic on port 443 to a fleet of Amazon EC2 instances in a private subnet. The instances are registered with a target group configured for HTTP health checks on port 80 using the path `/status`. The target group reports all EC2 instances as Unhealthy, and clients receive HTTP 502 (Bad Gateway) errors when trying to access the application. The administrator has verified that the web application is running and responding to local HTTPS requests on port 443 on the EC2 instances. Which of the following could be the root causes of the failing health checks? (Select TWO.)

  1. The target group health check is directed to port 80, but the web application server on the EC2 instances is only listening and responding on HTTPS port 443.Answer
  2. The security group for the EC2 instances allows inbound traffic on TCP port 443 from the ALB security group, but does not allow inbound TCP traffic on port 80.Answer
  3. C
    The Route 53 alias record targeting the ALB is configured with a latency routing policy, which disables health check evaluation for internal load balancers.
  4. D
    The stateless network ACL for the private subnet contains an inbound rule allowing port 80 but is missing an inbound rule for TCP ephemeral ports 1024-65535 to receive the health check requests.

Answer

The target group health check is directed to port 80, but the web application server on the EC2 instances is only listening on HTTPS port 443; and the security group for the EC2 instances does not allow inbound TCP traffic on port 80.
The health check configuration specifies HTTP on port 80, but the web application is only running and listening on port 443. Consequently, the load balancer's health check requests to port 80 will fail. Additionally, the security group of the EC2 instances must explicitly permit inbound TCP traffic on port 80 from the ALB security group to allow these health checks to reach the instances.

Step-by-Step Solution

1
Analyze the health check configuration and port mappings.
The target group sends health check requests to port 80 using HTTP, but the application is only listening and responding on HTTPS port 443.
Health checks fail when the target service does not listen on the designated health check port.
2
Verify security group rules between the ALB and the EC2 instances.
The security group allows inbound traffic on port 443 but blocks inbound traffic on port 80.
The EC2 instances' security group must permit inbound traffic on the specific port configured for health checks (port 80) from the ALB's security group.
3
Evaluate network ACL rules and Route 53 settings.
Route 53 routing policies do not control target group health checks. For stateless network ACLs, outbound rules must permit ephemeral ports for return traffic, rather than inbound rules.
To rule out other factors and confirm the correct root causes.

Key Concept

Elastic Load Balancing target group health check troubleshooting, including port mapping alignment, security group allowances, and network ACL rules.
Estimated Time:2m 0s
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic