Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A retail company's inventory platform is hosted on Amazon EC2 instances within a private subnet. The instances are registered to a target group associated with an Application Load Balancer (ALB). A SysOps administrator logs into the AWS Management Console and observes that all registered EC2 targets show an 'Unhealthy' status with the error description 'Health check failed'. The administrator checks the configuration and confirms that both the Security Groups and Network ACLs allow inbound HTTP traffic on the application port from the ALB. The ALB health check is configured to query the HTTP path '/health' on the traffic port. Which two configuration issues on the EC2 instances or the web server could be causing the health checks to fail? (Select two.)

  1. The web server software on the EC2 instances is configured to listen only on the loopback address (127.0.0.1) instead of the primary network interface.Answer
  2. The application web server requires a specific domain name in the HTTP Host header and returns a 404 Not Found response when queried by the ALB using the instance's private IP address.Answer
  3. C
    The target group is configured to send health check requests to a custom port that does not match the port on which the web server is listening.
  4. D
    The Route 53 active-passive failover routing policy is configured to route traffic to a secondary region, which disables target group health checks in the primary region.

Answer

The correct options are: the web server software listening only on the loopback address (127.0.0.1), and the application web server requiring a specific domain name in the HTTP Host header.
The health checks fail because the Application Load Balancer cannot establish a successful connection or receive a successful HTTP response code. First, if the web server daemon is bound to the loopback address (127.0.0.1) instead of the network interface address, it will not accept connections originating from the ALB. Second, if the web server configuration requires a specific domain name in the HTTP Host header, the default ALB health check (which uses the instance's private IP address in the Host header) will result in a 404 Not Found response, which does not match the expected success codes.

Step-by-Step Solution

1
Analyze the symptoms and the confirmed security settings.
Network connectivity is permitted because the security groups and network ACLs allow traffic on the configured port, meaning the failure is at the host or application layer.
To rule out network routing and access control policies as the source of the unhealthy status.
2
Evaluate the web server's network binding configuration.
If the web server is bound only to the loopback interface (127.0.0.1), it will reject requests arriving on the instance's private IP address from the ALB.
To verify if the daemon is correctly listening to external requests on the primary network interface (0.0.0.0).
3
Examine virtual host header requirements on the web server.
The ALB health checks send the target IP as the Host header. If the web server rejects this and demands a specific domain name, it returns a 404 response, which fails health check expectations.
To explain how an application-level configuration can prevent successful HTTP status code returns (typically 200 OK) for health checks.

Key Concept

Elastic Load Balancing Health Checks and Troubleshooting
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic