Examkin

Question

Difficulty: EasyElastic Load Balancing Health Checks and Troubleshooting

An application team deploys a new service on Amazon EC2 instances. The instances are registered to a target group associated with an Application Load Balancer. The load balancer's health checks are currently failing, showing the targets as unhealthy. The application logs indicate that the HTTP requests to the root path return a 403 Forbidden status because this endpoint is protected. A public, unauthenticated health status page is available at the '/ping' path. Additionally, the firewall rules on the EC2 instances do not permit any HTTP traffic from the load balancer.

To fix these failing health checks, which two configuration steps should be performed? (Select TWO.)

  1. Update the health check settings in the target group to request the '/ping' path.Answer
  2. Adjust the instance security group rules to allow inbound HTTP traffic from the load balancer's security group.Answer
  3. C
    Reconfigure the target group health check port to use port 8080.
  4. D
    Update the Route 53 latency routing policy to direct client traffic to the EC2 instances directly.
  5. E
    Modify the subnet network ACL rules to block outbound ephemeral ports (1024-65535).

Answer

Update the health check settings in the target group to request the '/ping' path, and adjust the instance security group rules to allow inbound HTTP traffic from the load balancer's security group.
The correct response components are: updating the health check path to the unauthenticated '/ping' path to resolve the 403 Forbidden error, and adjusting the instance security group rules to allow incoming HTTP traffic from the load balancer. These steps address both the network connectivity layer and the application response layer.

Step-by-Step Solution

1
Identify the cause of the health check failure from the application side.
The application returns a 403 Forbidden status code for the default root path because it requires authentication, whereas the '/ping' path is public and unauthenticated.
The Application Load Balancer health check expects a 200 OK response by default, so pointing it to the unauthenticated '/ping' path solves the HTTP status code failure.
2
Identify the cause of the network block between the load balancer and the targets.
The security group associated with the EC2 instances does not allow inbound HTTP traffic from the load balancer.
The security group must be updated to allow inbound HTTP traffic from the load balancer's security group so health check probes can reach the application.

Key Concept

Target Group Health Checks and Security Group Rules
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic