Examkin

Soru

Zorluk: OrtaAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a real-time telemetry processing API on Amazon EC2 instances within an Auto Scaling group (ASG). The instances are located in private subnets and run behind a public-facing Application Load Balancer (ALB). The API is configured to listen on TCP port 8080. The ALB target group has a target port of 8080, but the health check port is explicitly configured to port 80. The network ACL associated with the private subnets allows inbound TCP traffic on port 8080 from the public subnets, and outbound TCP traffic on port 8080 to the public subnets. Currently, all EC2 instances are marked unhealthy by the ALB, causing the ASG to repeatedly terminate and launch new instances. Which two actions must the solutions architect take to resolve this issue and ensure the instances are marked healthy? (Select two.)

  1. Modify the target group health check settings to use port 8080 or the traffic port.Cevap
  2. Modify the outbound network ACL of the private subnets to allow TCP traffic to the public subnets on ephemeral ports (1024-65535).Cevap
  3. C
    Add an outbound rule to the security group of the EC2 instances to allow traffic to the Application Load Balancer on ephemeral ports (1024-65535).
  4. D
    Change the Amazon Route 53 routing policy to latency-based routing to automatically redirect healthy traffic.
  5. E
    Configure the target group health check port to port 443 and set the protocol to HTTPS.

Cevap

Modify the target group health check settings to use port 8080 or the traffic port, and modify the outbound network ACL of the private subnets to allow TCP traffic to the public subnets on ephemeral ports (1024-65535).
To resolve the health check issues, two corrective configurations must be made. First, the target group's health check port must be changed to port 8080 (or the traffic port) to ensure the Application Load Balancer queries the actual port where the telemetry API is listening. Second, the outbound network ACL of the private subnets must be updated to allow traffic to ephemeral ports (1024-65535). Because network ACLs are stateless, return traffic from the EC2 instances back to the load balancer's dynamically allocated source ports will be dropped unless explicitly permitted by an outbound rule.

Adım Adım Çözüm

1
Analyze the target group health check port configuration.
Identify that the health checks are directed to port 80, while the application is bound to port 8080.
Correcting the health check port to match the application port is necessary for the load balancer to receive a valid response.
2
Evaluate the network ACL rules of the private subnets hosting the instances.
Identify that the outbound network ACL only allows TCP port 8080, blocking the return traffic to the load balancer's source ephemeral ports.
Since network ACLs are stateless, return traffic must be explicitly allowed on the destination ports of the response, which are the ephemeral ports used by the ALB.
3
Apply the configuration updates to the health check settings and the outbound network ACL.
The instances successfully pass health checks and are registered as healthy by the Application Load Balancer.
This establishes complete bidirectional network communication required for health check validation.

Anahtar Kavram

Application Load Balancer health checks must target the port where the application service is listening, and stateless network ACLs require outbound rules that cover return traffic on ephemeral ports.
Bu soruyu puanla

Konular

Auto Scaling and Elastic Load Balancing (ELB)

Bu konudan daha fazla soru