Examkin

Soru

Zorluk: OrtaElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is managing an Application Load Balancer (ALB) that routes traffic to a Target Group of Amazon EC2 instances. The Target Group is configured to receive HTTPS traffic on port 443443. The health check is configured to use the HTTP protocol on port 8080 targeting the `/health` endpoint. The security group associated with the EC2 instances allows inbound TCP traffic on port 443443 from the ALB's security group, but the ALB marks all instances as unhealthy. Which of the following actions should the administrator take to resolve this issue and allow the health checks to pass?

  1. A
    Modify the health check port in the target group configuration to use the traffic port (port 443443) but keep the protocol as HTTP.
  2. B
    Configure an Amazon Route 5353 DNS failover routing policy to bypass the load balancer and send traffic directly to the instances when health checks fail.
  3. Add a rule to the security group associated with the EC2 instances that allows inbound TCP traffic on port 8080 from the load balancer's security group.Cevap
  4. D
    Modify the stateless network ACL of the EC2 instances' subnet to allow outbound ephemeral port traffic (10241024-6553565535) to all destinations.

Cevap

Add a rule to the security group associated with the EC2 instances that allows inbound TCP traffic on port 8080 from the load balancer's security group.
Adding an inbound rule for TCP port 8080 from the load balancer's security group to the EC2 instances' security group resolves the issue because the Application Load Balancer performs health checks using the HTTP protocol on port 8080. Although the instances allow HTTPS traffic on port 443443, the health check requests on port 8080 were being blocked by the instances' security group.

Adım Adım Çözüm

1
Analyze the configuration of the load balancer and the targets.
The target group receives traffic on port 443443, but health checks are configured to use HTTP on port 8080.
Understanding which ports are used for application traffic versus health check traffic is critical to identifying potential network blocks.
2
Review the security group rules applied to the EC2 instances.
The EC2 security group allows traffic on port 443443 from the ALB security group, but does not have any rules allowing inbound traffic on port 8080.
Since the ALB sends health checks on port 8080, the instances' security group must explicitly allow inbound traffic from the ALB on port 8080.
3
Add the missing security group rule.
Inbound TCP port 8080 is allowed from the ALB's security group, causing the health checks to pass.
Allowing the HTTP health check traffic on port 8080 enables the ALB to connect to the target group instances and verify their health status.

Anahtar Kavram

Elastic Load Balancing target group health check security group configuration
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Elastic Load Balancing Health Checks and Troubleshooting

Bu konudan daha fazla soru