Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is managing an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in a private subnet. The instances host a web application listening on TCP port 8080. The ALB's target group is configured to perform health checks on HTTP port 8080. All target instances recently transitioned to an Unhealthy status, and the ALB is returning HTTP 502 Bad Gateway errors to clients. Security group rules allow inbound port 8080 traffic to the instances from the ALB, and outbound traffic from the instances is unrestricted. A custom Network Access Control List (NACL) is applied to the instance subnet. The NACL's inbound rules allow TCP port 8080 from the ALB's subnet, but all outbound rules have been removed. Which configuration change will resolve this issue and restore the instances to a healthy state?

  1. Add a rule to the subnet's Network ACL that allows outbound TCP traffic on ephemeral ports 1024-65535 to the ALB's subnet.Answer
  2. B
    Change the target group's health check configuration to use HTTP port 80 instead of port 8080.
  3. C
    Modify the Route 53 record set for the application to use an active-passive failover routing policy.
  4. D
    Add a route targeting the Internet Gateway in the route table associated with the private subnet.

Answer

Add an outbound rule to the subnet's Network Access Control List (NACL) that permits TCP traffic on ephemeral ports 1024-65535 to the Application Load Balancer's subnet.
Because Network ACLs are stateless, outbound traffic must be explicitly allowed. When the Application Load Balancer initiates a health check on port 8080, the instance responds using a destination port from the ephemeral port range (1024-65535). Since the outbound NACL rules were removed, this return traffic is dropped. Adding an outbound rule for the ephemeral port range to the ALB subnet allows the health check requests to be successfully completed.

Step-by-Step Solution

1
Analyze the components and rule behaviors.
The Security Groups are configured correctly, and the target group is configured to check the correct port (8080). The issue lies with the custom Network Access Control List (NACL) applied to the subnet of the EC2 instances.
Since security groups are stateful and NACLs are stateless, return traffic from a subnet must be explicitly allowed by the NACL outbound rules.
2
Determine the necessary traffic flow for the response.
The ALB initiates health check requests on TCP port 8080 (which is allowed by the inbound NACL rule). The response traffic from the EC2 instances back to the ALB will use the ALB's ephemeral port range.
Outbound NACL rules must permit the return traffic; otherwise, the load balancer will not receive the response, causing a health check timeout.
3
Identify the configuration change that allows the return traffic.
Adding an outbound NACL rule for TCP ports 1024-65535 to the ALB subnet allows the instances to complete the TCP handshake and respond to HTTP health checks.
This resolves the health check failures and restores the target status to healthy.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both inbound request traffic and outbound return traffic (ephemeral ports) to enable communication between the Application Load Balancer and target EC2 instances.
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic