Examkin

Soru

Zorluk: ZorElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is troubleshooting an issue with an Application Load Balancer (ALB). The ALB routes traffic to a fleet of Amazon EC2 instances running a web application on port 8080. In the AWS Management Console, all instances in the target group are marked as unhealthy with the status reason code 'Health.ResponseMismatch'. When analyzing the application logs on the EC2 instances, the administrator observes that incoming health check requests to the '/healthz' path are returning a '401 Unauthorized' status code because a global authentication middleware is applied. Which of the following actions should the administrator take to resolve this health check issue? (Select two.)

  1. Modify the web application configuration to bypass the authentication middleware for the '/healthz' path.Cevap
  2. Configure the target group's health check settings to include '401' in the success codes list.Cevap
  3. C
    Update the target group's health check configuration to use HTTP port 80 instead of the traffic-port.
  4. D
    Change the health check protocol to HTTPS to encrypt the request and bypass authentication.
  5. E
    Configure an active-passive Route 53 failover routing policy to route health checks directly to the EC2 instances.

Cevap

To resolve the health check failure, the administrator must either modify the web application configuration to bypass the authentication middleware for the '/healthz' path, or configure the target group's health check settings to include '401' in the success codes list.
The correct responses are to modify the web application configuration to bypass the authentication middleware for the '/healthz' path, and to configure the target group's health check settings to include '401' in the success codes list. By default, Application Load Balancers expect a 200 OK status code. Since the application blocks unauthorized requests with a 401 status code, the ALB marks the targets as unhealthy due to a response mismatch. Bypassing authentication for the health check endpoint restores the expected 200 OK response. Alternatively, configuring the ALB target group to accept 401 as a success code allows the health checks to pass despite the authentication block.

Adım Adım Çözüm

1
Analyze the health check failure reason and target group settings.
The target group is configured to expect a default success code of 200, but the targets are returning 401 Unauthorized due to authentication middleware.
This establishes that the network path is open (hence no timeout) but the application response code causes the Health.ResponseMismatch.
2
Evaluate application-side remediation options.
Excluding the '/healthz' endpoint from the global authentication middleware allows the application to respond with a 200 OK status code.
This is a standard best practice that enables external monitoring and load balancers to assess application health without exposing credentials.
3
Evaluate load balancer-side remediation options.
Updating the target group configuration to accept 401 in the success codes list allows the health check to pass using the existing application response.
This configuration accepts the 401 Unauthorized status as verification that the web server is running and responding.

Anahtar Kavram

Handling Application Load Balancer health check status code mismatches by either aligning application response codes or load balancer success code expectations.
Bu soruyu puanla

Konular

Elastic Load Balancing Health Checks and Troubleshooting

Bu konudan daha fazla soru