Examkin

Soru

Zorluk: OrtaAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a microservice on Amazon EC2 instances inside private subnets. The instances are managed by an Auto Scaling group (ASG) behind a public Application Load Balancer (ALB). The microservice is configured to listen on TCP port 8080. The ALB target group is configured to send health check requests to the instances on port 8080. After a security audit, a network engineer modified the custom network access control list (network ACL) associated with the private subnets. Shortly after, the ALB target group health checks began failing, marking all EC2 instances as unhealthy. The security group associated with the EC2 instances correctly allows inbound traffic on port 8080 from the ALB's security group. Which action should the solutions architect take to resolve this issue and restore service availability?

  1. A
    Modify the target group health check configuration to query port 80 instead of port 8080 to align with the Application Load Balancer's public listener.
  2. B
    Add an outbound rule to the EC2 instances' security group that explicitly allows return traffic to the Application Load Balancer on ephemeral ports.
  3. Update the subnet network ACL to allow outbound traffic on ephemeral ports (1024-65535) to the load balancer's subnets.Cevap
  4. D
    Create an Amazon Route 53 Latency routing policy pointing directly to the EC2 instances' private IP addresses to bypass the load balancer's health checks.

Cevap

Update the subnet network ACL to allow outbound traffic on ephemeral ports (1024-65535) to the load balancer's subnets.
The correct solution is to allow outbound ephemeral port traffic in the private subnets' network ACL. Because network ACLs are stateless, allowing inbound traffic on port 8080 is not enough; the return traffic from the instances back to the load balancer (which uses ephemeral ports as source ports) must be explicitly permitted in the outbound rules.

Adım Adım Çözüm

1
Analyze the health check failure context.
The application is running on port 8080, and the instance security groups correctly allow inbound traffic on port 8080 from the ALB. The health checks started failing immediately after network ACL modifications.
To narrow down the root cause to the stateless network ACL layer.
2
Evaluate how stateless network ACLs process health check traffic.
The ALB initiates TCP connections to the EC2 instances on port 8080 using ephemeral source ports (1024-65535). Because network ACLs are stateless, return traffic from the EC2 instances to the ALB must be explicitly allowed on these ephemeral ports.
To determine the required rule to allow the health check responses to return to the ALB.
3
Select the configuration change that addresses the stateless nature of network ACLs.
Adding an outbound rule to the private subnet network ACL allowing ephemeral port traffic to the ALB subnets restores health check traffic flow.
To establish successful health check validation and make the instances healthy in the target group.

Anahtar Kavram

ELB health checks require appropriate configuration of security groups and stateless Network ACLs (NACLs) to ensure bidirectional communication.
Bu soruyu puanla

Konular

Auto Scaling and Elastic Load Balancing (ELB)

Bu konudan daha fazla soru