Examkin

Soru

Zorluk: OrtaAuto Scaling and Elastic Load Balancing (ELB)

A technology company hosts a containerized catalog API on Amazon EC2 instances within a private subnet. The instances are managed by an Auto Scaling group and are registered with an Application Load Balancer (ALB) that resides in a public subnet. The API service runs on port 8080. The target group is configured to perform health checks on port 8080. The security group of the EC2 instances is configured to allow inbound traffic on port 8080 from the ALB's security group. To meet security requirements, a network administrator applied a custom Network ACL to the private subnet, adding an inbound rule that allows traffic on port 8080 from the ALB's subnet. However, the health checks are now failing, and the ALB reports all EC2 instances as unhealthy. Which action should the solutions architect take to resolve the health check failure?

  1. Add an outbound rule to the private subnet's Network ACL to allow traffic to the ephemeral ports of the Application Load Balancer's subnet.Cevap
  2. B
    Add an outbound rule to the EC2 instances' Security Group to allow return traffic on ephemeral ports, because Security Groups are stateless and require explicit return rules.
  3. C
    Modify the target group health check configuration to use the default HTTP port 80 instead of port 8080, as Elastic Load Balancing health checks must query port 80 to bypass subnet-level restrictions.
  4. D
    Configure an Amazon Route 53 latency routing policy to route traffic directly to the private IP addresses of the EC2 instances to bypass the subnet's Network ACL.

Cevap

Add an outbound rule to the private subnet's Network ACL to allow traffic to the ephemeral ports of the Application Load Balancer's subnet.
The correct option is to add an outbound rule to the private subnet's Network ACL. Since Network ACLs are stateless, allowing inbound traffic on port 8080 is not sufficient; the return traffic from the EC2 instances (source port 8080) to the ALB (destination ephemeral ports 1024-65535) must be explicitly permitted by an outbound rule on the private subnet's Network ACL.

Adım Adım Çözüm

1
Analyze the network configuration of the Application Load Balancer (ALB) and EC2 instances.
The ALB is in a public subnet, and the EC2 instances are in a private subnet. The EC2 instances listen on port 8080, which is also the target group port and the health check port.
Understanding the traffic flow helps locate where the network packet is blocked.
2
Evaluate the stateful and stateless components in the communication path.
Security groups are stateful, so inbound traffic allowed on port 8080 will automatically allow outbound return traffic. Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.
Since a custom Network ACL was applied, both incoming requests and outgoing responses must have matching rules.
3
Determine the required outbound rule for the Network ACL.
The load balancer sends health check requests from ephemeral ports (1024-65535) to port 8080 on the instances. When the instances reply, the return traffic is sent from port 8080 back to the load balancer's ephemeral ports. Therefore, the private subnet's Network ACL needs an outbound rule allowing traffic to the ALB subnet on ephemeral ports.
This completes the stateless return path, allowing the health check to succeed.

Anahtar Kavram

Network ACLs are stateless firewall rules at the subnet level, meaning that return traffic must be explicitly allowed via outbound rules, whereas Security Groups are stateful and allow return traffic automatically.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Auto Scaling and Elastic Load Balancing (ELB)

Bu konudan daha fazla soru