Examkin

Question

Difficulty: MediumElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator has deployed an Application Load Balancer (ALB) to distribute traffic to a fleet of Amazon EC2 instances in a private subnet. The web application listens on TCP port 5000. The target group is configured to perform HTTP health checks on port 5000 with the path `/ping`. However, all EC2 instances are showing an `Unhealthy` status with the reason `Health check target response code mismatch [404]`. Upon checking the application server logs, the administrator finds that the application's health endpoint is actually mapped to `/status` on TCP port 5000, and HTTP GET requests to `/ping` return a `404 Not Found` error. Additionally, the instance security group allows inbound traffic only from the ALB's security group on TCP port 443.

Which two changes must the SysOps administrator make to resolve the health check issues and allow the instances to pass health checks? (Select two.)

  1. Update the target group health check path to /status.Answer
  2. Update the instance security group to allow inbound TCP traffic on port 5000 from the ALB security group.Answer
  3. C
    Change the target group health check port to 443.
  4. D
    Configure an Amazon Route 53 active-passive failover routing policy to bypass the load balancer.
  5. E
    Add a new rule to the Network ACL of the private subnet to allow inbound traffic on TCP port 443 from the public subnet.

Answer

To resolve the health check issues, the SysOps administrator must update the target group health check path to /status and update the instance security group to allow inbound TCP traffic on port 5000 from the ALB security group.
The Application Load Balancer requires both a correct health check endpoint and permissions to reach the target instances on the application port. Since the endpoint is mapped to /status and the application runs on port 5000, updating the path to /status and opening port 5000 on the instance security group allows the ALB health checks to succeed.

Step-by-Step Solution

1
Analyze the HTTP response code returned by the health check.
The target group shows a 404 response code for the path /ping, indicating the path does not exist on the application server.
Correcting the path to the actual endpoint (/status) is necessary for the health check to find the resource and return a successful 200 OK status.
2
Check the security group rules of the EC2 instances.
The instances only permit inbound traffic on port 443 from the ALB, blocking requests on the application port 5000.
Since the ALB is configured to send traffic and health checks to port 5000, the security group rules must be updated to allow inbound TCP traffic on port 5000 from the ALB security group.

Key Concept

Successful Application Load Balancer health checks require the correct health check path and permission for the load balancer to access the target group's port in the instance's security group.
Estimated Time:2m 0s
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic