Examkin

Soru

Zorluk: ZorElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is managing an API service hosted on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run a secure service that listens on port 8443. The ALB target group is configured to send HTTPS health checks to port 8443 on the path `/api/v1/health`. All EC2 instances in the target group are reported as unhealthy. When the administrator connects to an instance and runs `curl -k https://localhost:8443/api/v1/health`, the response returns a status of `200 OK`. However, the ALB target group console indicates the health check is failing with an HTTP `401 Unauthorized` status code. Which of the following actions will resolve this health check issue?

  1. Configure the API application on the instances to permit anonymous access to the `/api/v1/health` path, or change the target group health check path to an unauthenticated endpoint.Cevap
  2. B
    Modify the target group's health check protocol from HTTPS to HTTP on port 8443 to bypass application-level SSL/TLS handshake requirements.
  3. C
    Configure a Route 53 active-passive failover routing policy and link the target group's health check to the primary alias record.
  4. D
    Update the security group of the EC2 instances to allow inbound TCP traffic on port 443 from the security group of the ALB.

Cevap

Configure the API application on the instances to permit anonymous access to the `/api/v1/health` path, or change the target group health check path to an unauthenticated endpoint.
The correct answer is to allow unauthenticated access to the health check path or use a different endpoint that does not require authentication. An Application Load Balancer health check probe does not support authentication headers or client certificates. A response status of 401 Unauthorized indicates that the web server or application is prompting for credentials, which results in the ALB marking the target as unhealthy.

Adım Adım Çözüm

1
Analyze the error message reported by the Application Load Balancer target group.
The target group reports an HTTP 401 status code, which means 'Unauthorized'.
This indicates that the ALB successfully reached the target EC2 instance, but the application demanded authentication credentials which the ALB does not provide.
2
Verify local service status on the EC2 instance.
Running `curl -k https://localhost:8443/api/v1/health` returns `200 OK`.
This local command may succeed due to bypass rules for localhost, or because the administrator was pre-authenticated, masking the restriction imposed on external clients (like the ALB).
3
Determine the corrective action to satisfy the ALB health check requirements.
Modify the application configuration to allow unauthenticated access to the health check endpoint, or point the health check to a non-authenticated path.
ELB health checks cannot present authentication tokens or certificates for application-level basic/bearer authentication, so the targeted endpoint must be publicly accessible to the ALB's internal queries.

Anahtar Kavram

Application Load Balancer health checks require a response that matches the configured successful codes (typically 200). If the health check path requires authentication, the ALB will receive a 401/403 response, failing the health check.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Elastic Load Balancing Health Checks and Troubleshooting

Bu konudan daha fazla soru