Examkin

Soru

Zorluk: OrtaAuto Scaling and Elastic Load Balancing (ELB)

A company runs a REST API service on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an internal Application Load Balancer (ALB). The API service is configured to listen on port 9090, while a dedicated health status endpoint is exposed on port 9095. The security group of the EC2 instances is currently configured to allow inbound TCP traffic on port 9090 from the ALB security group. However, the ALB target group health checks are failing, leading the ALB to mark all instances as unhealthy and prompting the ASG to continuously terminate and replace instances. Which two configurations must a solutions architect implement to resolve the health check failures and prevent unnecessary instance replacements? (Select two.)

  1. Modify the EC2 instance security group to allow inbound traffic on TCP port 9095 from the security group of the Application Load Balancer.Cevap
  2. Update the target group health check configuration to explicitly use port 9095.Cevap
  3. C
    Configure the target group health check port settings to use "traffic-port".
  4. D
    Modify the subnet's Network ACL to allow inbound traffic on port 9095, relying on its connection-tracking features to automatically allow the return traffic.
  5. E
    Set up an Amazon Route 53 latency routing policy pointing to the Application Load Balancer to bypass the unhealthy targets.

Cevap

Modify the EC2 instance security group to allow inbound traffic on TCP port 9095 from the security group of the Application Load Balancer, and update the target group health check configuration to explicitly use port 9095.
To resolve the health check issues, the solutions architect must ensure that the load balancer can reach the health status endpoint. Because the health status page is served on port 9095 instead of the application traffic port (9090), the target group health check port must be explicitly configured to use port 9095. Additionally, because security groups are stateful, the EC2 instance security group must be updated to allow inbound TCP traffic on port 9095 from the load balancer's security group so that the health probe requests are not blocked at the instance boundary.

Adım Adım Çözüm

1
Analyze target group health check port settings.
By default, the Application Load Balancer performs health checks on the 'traffic-port' (port 9090). Since the health endpoint is on port 9095, the health check port configuration must be changed from 'traffic-port' to port 9095.
This aligns the Application Load Balancer's health check probes with the port where the health status service is running.
2
Analyze security group rules for the instances.
The current security group only allows inbound traffic on port 9090. A new rule must be added to allow inbound traffic on port 9095 from the ALB security group.
This permits the Application Load Balancer to successfully establish TCP connections to the health status service on port 9095.

Anahtar Kavram

ELB Target Group Health Checks and Security Group Rules
Bu soruyu puanla

Konular

Auto Scaling and Elastic Load Balancing (ELB)

Bu konudan daha fazla soru