An organization's deployment contains an Application Load Balancer (ALB) that routes traff… — AWS Certified SysOps Administrator - Associate

An organization's deployment contains an Application Load Balancer (ALB) that routes traffic to a fleet of Amazon EC2 instances. The application operates on port $5000$ , and the target group is configured to use port $5000$ for routing. A dedicated health monitoring service runs on the instances on port $9000$ , and the target group's health check port is explicitly configured to $9000$ . All instances are currently marked as unhealthy with the status code `HealthCheck.Timeout`. The administrator reviews the security rules:

- The security group assigned to the ALB allows inbound HTTPS traffic on port $443$ from $0.0.0.0/0$ . Its outbound rules only allow TCP traffic on port $5000$ directed to the EC2 instances' security group.
- The security group assigned to the EC2 instances allows inbound TCP traffic on port $5000$ from the ALB security group. All outbound traffic is permitted.

Which two configuration changes are required to allow the health checks to pass? (Select two.)

Add an outbound rule to the ALB's security group to allow TCP traffic on port $9000$ to the security group of the EC2 instances.Answer
Add an inbound rule to the security group of the EC2 instances to allow TCP traffic on port $9000$ from the security group of the ALB.Answer
C
Modify the target group's health check configuration to use HTTP port $5000$ and set the path to `/health`.
D
Modify the subnet network ACLs to allow inbound TCP traffic on port $9000$ but deny outbound ephemeral ports ( $1024$ - $65535$ ) to ensure security compliance.
E
Configure a Route 53 active-passive failover routing policy to route traffic to a secondary static resource when the primary target group is unhealthy.

Answer

To resolve the health check timeouts, both the outbound rules of the ALB's security group and the inbound rules of the EC2 instances' security group must be updated to permit TCP traffic on port

9000

The health checks are timing out because TCP port

9000

traffic is blocked. Since the health check port is explicitly set to

9000

, the ALB must be permitted to send outbound traffic on port

9000

, and the EC2 instances must be permitted to accept inbound traffic on port

9000

. Adding the outbound rule to the ALB's security group and the inbound rule to the EC2 instances' security group establishes this connectivity.

Step-by-Step Solution

Identify the port configured for target group health checks, which is port

9000

This establishes that the health check traffic travels from the ALB to the EC2 instances on TCP port

9000

Health checks must have a clear path on the designated port through all firewalls.

Review the outbound rules of the ALB's security group.

The current rule restricts outbound traffic to port

5000

. Update it to allow TCP traffic on port

9000

to the security group of the EC2 instances.

This allows the ALB to send health check requests to the instances on port

9000

Review the inbound rules of the EC2 instances' security group.

The current rule only allows inbound traffic on port

5000

. Update it to allow TCP traffic on port

9000

from the ALB security group.

This permits the EC2 instances to accept the health check traffic from the ALB.

Key Concept

Security groups are stateful firewalls; however, both the source (ALB) and destination (EC2) security groups must explicitly allow traffic on the health check port if the default 'allow all outbound' rule is restricted.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic