Examkin

Soru

Zorluk: Çok zorAuto Scaling and Elastic Load Balancing (ELB)

A company hosts a secure financial transaction processing service on Amazon EC2 instances managed by an Auto Scaling group (ASG). The instances are registered with a target group for an Application Load Balancer (ALB). The application listens on port 8443. However, due to security compliance, the application health check endpoint runs on a separate administrative service on port 8080 on the same instances. The target group is configured with the port set to 8443, and the health check port is set to the default 'traffic-port'. The EC2 instances are in private subnets, while the ALB is in public subnets. Custom Network ACLs (NACLs) are applied to both subnets. The security groups are configured to allow port 8443 and port 8080 inbound from the ALB security group, and outbound security groups are configured to allow all traffic. After deployment, the ALB marks all targets as unhealthy, and the ASG begins continuously terminating and replacing the instances. Which combination of actions will resolve this issue? (Select two.)

  1. Modify the target group's health check configuration to explicitly set the health check port to 8080.Cevap
  2. Add an outbound rule to the private subnet's Network ACL allowing traffic to the public subnets on ephemeral ports (1024-65535).Cevap
  3. C
    Change the target group port configuration to 8080 and keep the health check port set to the default traffic-port.
  4. D
    Modify the security group of the EC2 instances to allow outbound traffic to the ALB security group on ephemeral ports (1024-65535).
  5. E
    Configure a Route 53 latency routing policy with target health evaluation enabled pointing directly to the private IP addresses of the EC2 instances.

Cevap

To resolve the health check failure, you must override the target group health check port configuration to explicitly probe port 8080, and add an outbound rule to the private subnet's Network ACL to permit return traffic to the public subnets on ephemeral ports (1024-65535).
The correct options are the actions to modify the target group's health check configuration to explicitly set the health check port to port 8080, and to add an outbound rule to the private subnet's Network ACL allowing traffic to the public subnets on ephemeral ports (1024-65535). Overriding the health check port is necessary because the target group traffic port (8443) does not host the health check service. Furthermore, because Network ACLs are stateless, an outbound rule is required on the private subnet to permit the return traffic initiated by the load balancer, which falls within the ephemeral port range.

Adım Adım Çözüm

1
Analyze the target group configuration and locate the port mismatch.
The target group is configured to forward client traffic to port 8443, but the health check port is set to 'traffic-port'. This causes the ALB to probe port 8443 for health checks, whereas the administrative service only listens on port 8080.
By default, the target group uses the traffic port for health checks unless overridden.
2
Identify the remedy for the health check port mismatch.
Modify the target group settings to override the health check port, changing it from 'traffic-port' to 8080.
This directs the ALB health probes to the correct service running on the instances.
3
Evaluate the network filtering layer for potential blocks.
Since the ALB is in the public subnets and the EC2 instances are in the private subnets with custom Network ACLs, we must assess NACL rules. Security groups are stateful and allow return traffic automatically, but Network ACLs are stateless.
Stateless filters require explicit rules for both inbound request traffic and outbound return traffic.
4
Formulate the correct Network ACL configuration.
Ensure the private subnet's Network ACL has an outbound rule allowing traffic back to the public subnets (where the ALB resides) on ephemeral ports (1024-65535).
When the ALB establishes a connection to the backend target, the response traffic from the target is sent back using the ephemeral port range of the client (the ALB).

Anahtar Kavram

Configuring load balancer health checks on custom ports requires overriding the target group health check settings, and ensuring stateless network filters (Network ACLs) are configured to permit return traffic on ephemeral ports.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Auto Scaling and Elastic Load Balancing (ELB)

Bu konudan daha fazla soru