Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A company hosts a web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application listens on port 8080. The target group is configured to perform health checks using the HTTP protocol on port 8080 with the path `/status`. Following a security update, the application now requires an API key in the HTTP header for all requests under the `/status` path, returning an HTTP 401 Unauthorized response to requests without the key. As a result, the ALB target group marks all instances as unhealthy. Which action should a SysOps administrator take to resolve this issue?

  1. Configure a new, unauthenticated endpoint on the application, such as `/health`, that does not require an API key, and update the target group's health check path to `/health`.Answer
  2. B
    Update the target group's health check settings to include 401 in the list of successful HTTP matcher codes.
  3. C
    Modify the ALB listener rule to inject a custom HTTP header containing the valid API key for all incoming health check requests.
  4. D
    Configure an Amazon Route 53 active-passive failover routing policy to route traffic directly to the EC2 instances' public IP addresses, bypassing the ALB health checks.

Answer

Configure a new, unauthenticated endpoint on the application, such as `/health`, that does not require an API key, and update the target group's health check path to `/health`.
The correct action is to create a new, unauthenticated endpoint on the application (such as `/health`) that returns a 200 OK status code, and update the target group to use this path. Since Application Load Balancers generate anonymous health check requests without custom headers, any endpoint requiring API keys or basic authentication will fail the health check. A dedicated, unauthenticated health check endpoint allows the target group to verify instance health safely.

Step-by-Step Solution

1
Identify the cause of the health check failure from the status code.
The target group is receiving an HTTP 401 Unauthorized status code because the `/status` endpoint now requires an API key in the request headers.
Target group health checks are sent as anonymous HTTP requests without custom headers, causing the authentication check to fail on the instances.
2
Evaluate configuration workarounds for the authentication requirement.
Since Application Load Balancers cannot be configured to inject custom headers into target group health checks, and adding 401 to success matchers compromises health check reliability, a separate endpoint must be used.
A clean separation of authenticated business logic and unauthenticated health reporting is required.
3
Create and configure a dedicated health check endpoint.
Create an unauthenticated `/health` endpoint on the web server that returns HTTP 200 OK when the application is functional, and update the target group health check path accordingly.
This allows the target group to verify that the web server is running and responding without requiring authentication credentials.

Key Concept

ELB Target Group Health Checks and Authentication
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic