Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator has configured an Application Load Balancer (ALB) to route HTTP traffic to a target group of Amazon EC2 instances. The application runs on port 5000, and the target group is configured to use port 5000 with a health check path of `/healthz`. The EC2 instances are located in a private subnet, while the ALB is in a public subnet. All instances in the target group are showing as unhealthy, and users receive an HTTP 503 Service Unavailable error when attempting to connect to the application. Which of the following could be causing this issue? (Select TWO.)

  1. The stateless Network Access Control List (NACL) associated with the private subnet does not have an outbound rule allowing ephemeral port traffic (1024-65535) back to the ALB subnets.Answer
  2. The application's `/healthz` endpoint requires user authentication and returns an HTTP 401 response code instead of the default healthy HTTP status codes.Answer
  3. C
    The Route 53 alias record pointing to the ALB is configured with an active-passive failover routing policy, but the record is not associated with a Route 53 health check.
  4. D
    The security group of the EC2 instances does not permit inbound ICMP ping traffic from the security group of the ALB.
  5. E
    The public subnet's route table lacks a route targeting the Internet Gateway (IGW), preventing the ALB from communicating with the EC2 instances.

Answer

The stateless Network Access Control List (NACL) associated with the private subnet lacks an outbound rule to allow ephemeral port traffic (1024-65535) back to the ALB subnets, and the application's `/healthz` endpoint requires user authentication and returns an HTTP 401 response code.
The stateless Network Access Control List (NACL) associated with the private subnet must permit outbound ephemeral port traffic back to the ALB subnets to allow return health check response packets. Additionally, target group health checks expect an HTTP 200-299 response by default. If the `/healthz` endpoint requires authentication and returns an HTTP 401 status code, the ALB will mark the instances as unhealthy.

Step-by-Step Solution

1
Analyze how ALB health check probes function and evaluate status codes.
Determine that the ALB expects a status code between 200-299. If the endpoint requires authentication, it returns a 401 code, causing the health check to fail.
This checks the validity of the application response format against ELB standards.
2
Evaluate the stateful vs. stateless traffic characteristics of security groups and NACLs.
Verify that while security groups automatically handle return traffic, stateless NACLs require an explicit outbound rule for ephemeral ports (1024-65535) to allow return packets back to the ALB.
This ensures network-level traffic is allowed to return to the source of the probe.
3
Examine the scope of external routing components like Route 53 and Internet Gateways.
Recognize that Route 53 and Internet Gateways affect public ingress but do not interfere with internal VPC routing between the ALB and private instances.
This rules out external DNS and gateway configurations as potential causes.

Key Concept

ALB Target Group Health Check and VPC Network Troubleshooting
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic