Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that is failing to route traffic to a target group of Amazon EC2 instances located in a private subnet. The web application on the instances is configured to listen on port 80808080, and the target group is configured to perform health checks on the same port. The ALB health checks are consistently failing with a timeout status. The ALB is in a public subnet, and its security group allows inbound traffic on ports 8080 and 443443 from `0.0.0.0/0`. Which of the following actions should the SysOps administrator take to resolve the unhealthy target status?

  1. Modify the security group associated with the EC2 instances to allow inbound TCP traffic on port 80808080 from the security group of the ALB.Answer
  2. B
    Update the target group health check port to port 8080 and verify that the application listens on port 8080.
  3. C
    Add a route pointing to the Internet Gateway in the route table of the private subnet hosting the EC2 instances.
  4. D
    Configure a Route 5353 Active-Passive failover routing policy to redirect traffic to a backup target group.

Answer

Modify the security group associated with the EC2 instances to allow inbound TCP traffic on port 80808080 from the security group of the ALB.
The Application Load Balancer (ALB) must be able to establish a TCP connection to the EC2 instances on the configured health check port, which is port 80808080 in this scenario. Since the targets are reporting a timeout status rather than an HTTP error code (like 403 or 404), this indicates that the network packets are being dropped. To resolve this, the security group associated with the EC2 instances must be updated to allow inbound TCP traffic on port 80808080 from the source security group of the ALB. This allows the health check traffic to reach the application.

Step-by-Step Solution

1
Analyze the health check failure status, which is 'HealthCheck.Timeout'. This indicates that the load balancer can send a request but does not receive a response within the timeout period.
Identify that a network path block (e.g., security group, network ACL, or host firewall) is the most likely cause of the packet drop.
Health check timeouts are typically caused by network connectivity issues preventing the request from reaching the instance or the response from getting back to the load balancer.
2
Examine the security group configuration of the EC2 instances relative to the load balancer.
Determine that the EC2 instances are listening on port 80808080 and the target group performs health checks on that port, so the instances' security group must allow inbound traffic on port 80808080 from the ALB.
If the security group of the EC2 instances does not explicitly permit traffic on port 80808080 from the ALB's security group, the health check requests will be silently dropped, causing a timeout.
3
Evaluate the distractors to rule out incorrect architectures.
Confirm that changing the health check port to 8080 fails because the application listens on 80808080; adding an Internet Gateway route is incorrect for private instances; and Route 5353 failover does not fix the target group health.
Troubleshooting requires identifying the root cause of the target health failure rather than applying unrelated changes or workarounds.

Key Concept

Target group health checks require proper security group configurations allowing the ALB to communicate with the instances on the health check port.
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic