Examkin

Question

Difficulty: Very hardElastic Load Balancing Health Checks and Troubleshooting

An Application Load Balancer (ALB) is configured to distribute traffic to a fleet of Amazon EC2 instances in private subnets. The EC2 instances run a web application that listens on TCP port 8443 (HTTPS) for client traffic. The Target Group configuration specifies a custom health check on TCP port 8080 (HTTP) with the path `/healthz`. Recently, the SysOps Administrator observed that all EC2 instances in the Target Group are marked as unhealthy, with the health status detail displaying: 'Health check failed with HTTP code 401: Unauthorized'. In addition, a recent security group cleanup has caused connection timeouts on port 8080 during target registration. Which of the following actions should the SysOps Administrator take to resolve these issues and restore the target health status to healthy? (Select TWO.)

  1. Modify the application configuration on the EC2 instances to permit unauthenticated access to the `/healthz` pathAnswer
  2. Update the security group associated with the EC2 instances to allow inbound TCP traffic on port 8080 from the Application Load Balancer's security groupAnswer
  3. C
    Change the target group health check settings to use HTTPS on port 8443 with the path `/`
  4. D
    Modify the private subnets' Network Access Control List (NACL) to allow inbound traffic on TCP port 8080, relying on stateless evaluation to automatically permit the return traffic
  5. E
    Configure an Amazon Route 53 active-passive failover routing policy on the ALB's DNS record to failover traffic to a secondary target group when the primary targets are unhealthy

Answer

Modify the application configuration on the EC2 instances to permit unauthenticated access to the `/healthz` path, and update the security group associated with the EC2 instances to allow inbound TCP traffic on port 8080 from the Application Load Balancer's security group.
The target instances are returning HTTP 401 (Unauthorized) because the `/healthz` health check endpoint requires authentication. Modifying the application configuration to allow unauthenticated access to this path resolves this error. Additionally, because the health checks are configured to run on port 8080 rather than the default traffic port (8443), the instance security group must explicitly permit inbound TCP traffic on port 8080 from the Application Load Balancer's security group to prevent connection timeouts.

Step-by-Step Solution

1
Analyze the health check failure status code 401 Unauthorized.
Determine that the `/healthz` path on the EC2 instances requires authentication, which prevents the Application Load Balancer from receiving a success status code (typically 200 OK).
An ELB health check requires a successful HTTP response code (configured in the target group, default is 200) to mark a target as healthy.
2
Analyze the connection timeout issue on port 8080.
Determine that security group rules on the EC2 instances do not allow inbound traffic from the load balancer on TCP port 8080.
Because the health check is configured on port 8080 instead of the standard application port 8443, the security group must be explicitly configured to allow the load balancer to connect to port 8080.
3
Formulate the resolutions.
Configure the application to allow unauthenticated access to the `/healthz` path, and update the security group rules to permit inbound traffic on port 8080 from the ALB security group.
These actions directly resolve both the HTTP 401 Unauthorized status code and the connection timeout symptoms.

Key Concept

Elastic Load Balancing Health Checks and Security Group Configuration
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic