Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A company hosts a web application on Amazon EC2 instances located in a private subnet. The instances are registered in a target group for an Application Load Balancer (ALB) that is deployed in the public subnets of the same VPC. The target group is configured for HTTP health checks on port 8080.

A SysOps administrator observes that all EC2 instances in the target group are marked as unhealthy. The administrator confirms that the web application is actively listening on TCP port 8080 on the EC2 instances. The security group for the EC2 instances allows inbound TCP traffic on port 8080 from the ALB security group.

The custom Network Access Control List (NACL) for the private subnet has an inbound rule allowing TCP traffic on port 8080 from the public subnets. However, the outbound rules for the private subnet's NACL only allow TCP traffic on ports 80 and 443 to the public subnets.

Which modification should the administrator make to resolve the failing health checks?

  1. Add an outbound rule to the private subnet's Network ACL that allows TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets.Answer
  2. B
    Add an outbound rule to the private subnet's Network ACL that allows TCP traffic on port 8080 to the public subnets.
  3. C
    Change the target group's health check configuration port to port 80 so that it matches the outbound NACL rule.
  4. D
    Create an active-passive Route 53 failover routing policy that routes health check traffic directly to the EC2 instances.

Answer

Add an outbound rule to the private subnet's Network ACL that allows TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets.
The correct answer is to add an outbound rule to the private subnet's Network ACL that allows TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets. This is because Network ACLs are stateless. When the ALB initiates a health check request to the EC2 instances, it uses an ephemeral port (10241024-6553565535) as the source port. The response from the EC2 instance is sent back to this ephemeral port, so the private subnet's outbound NACL rules must allow traffic to these ephemeral ports.

Step-by-Step Solution

1
Analyze the network path and stateless nature of Network ACLs (NACLs).
NACLs are stateless, meaning return traffic must be explicitly allowed by an outbound rule.
Since the ALB is initiating connections to the EC2 instances, the return traffic from the EC2 instances back to the ALB must match an outbound NACL rule.
2
Identify the source and destination ports for the return traffic.
The request is sent from the ALB (using an ephemeral source port in the range 10241024-6553565535) to the EC2 instance (destination port 8080). Therefore, the return response from the EC2 instance goes from source port 8080 to the destination ephemeral port (10241024-6553565535).
To allow this response traffic through the private subnet's NACL, an outbound rule must allow traffic to ephemeral ports (10241024-6553565535).
3
Select the option that allows outbound traffic on the destination ephemeral ports to the public subnets.
Adding an outbound rule allowing TCP traffic on ephemeral ports (10241024-6553565535) to the public subnets allows the health check response to return to the ALB.
This fixes the blocked response traffic and allows health checks to succeed.

Key Concept

NACLs are stateless network security controls, meaning both inbound request traffic and outbound return traffic must be explicitly allowed. When an ALB initiates an HTTP request (like a health check) to a target, the return traffic from the target is sent to the ALB's ephemeral port, which requires outbound NACL rules to allow ephemeral ports (10241024-6553565535).
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic