A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that is faili… — AWS Certified SysOps Administrator - Associate

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that is failing to route traffic to a target group of Amazon EC2 instances located in a private subnet. The web application on the instances is configured to listen on port $8080$ , and the target group is configured to perform health checks on the same port. The ALB health checks are consistently failing with a timeout status. The ALB is in a public subnet, and its security group allows inbound traffic on ports $80$ and $443$ from `0.0.0.0/0`. Which of the following actions should the SysOps administrator take to resolve the unhealthy target status?

Modify the security group associated with the EC2 instances to allow inbound TCP traffic on port $8080$ from the security group of the ALB.Cevap
B
Update the target group health check port to port $80$ and verify that the application listens on port $80$ .
C
Add a route pointing to the Internet Gateway in the route table of the private subnet hosting the EC2 instances.
D
Configure a Route $53$ Active-Passive failover routing policy to redirect traffic to a backup target group.

Cevap

Modify the security group associated with the EC2 instances to allow inbound TCP traffic on port

8080

from the security group of the ALB.

The Application Load Balancer (ALB) must be able to establish a TCP connection to the EC2 instances on the configured health check port, which is port

8080

in this scenario. Since the targets are reporting a timeout status rather than an HTTP error code (like 403 or 404), this indicates that the network packets are being dropped. To resolve this, the security group associated with the EC2 instances must be updated to allow inbound TCP traffic on port

8080

from the source security group of the ALB. This allows the health check traffic to reach the application.

Adım Adım Çözüm

Analyze the health check failure status, which is 'HealthCheck.Timeout'. This indicates that the load balancer can send a request but does not receive a response within the timeout period.

Identify that a network path block (e.g., security group, network ACL, or host firewall) is the most likely cause of the packet drop.

Health check timeouts are typically caused by network connectivity issues preventing the request from reaching the instance or the response from getting back to the load balancer.

Examine the security group configuration of the EC2 instances relative to the load balancer.

Determine that the EC2 instances are listening on port

8080

and the target group performs health checks on that port, so the instances' security group must allow inbound traffic on port

8080

from the ALB.

If the security group of the EC2 instances does not explicitly permit traffic on port

8080

from the ALB's security group, the health check requests will be silently dropped, causing a timeout.

Evaluate the distractors to rule out incorrect architectures.

Confirm that changing the health check port to

80

fails because the application listens on

8080

; adding an Internet Gateway route is incorrect for private instances; and Route

53

failover does not fix the target group health.

Troubleshooting requires identifying the root cause of the target health failure rather than applying unrelated changes or workarounds.

Anahtar Kavram

Target group health checks require proper security group configurations allowing the ALB to communicate with the instances on the health check port.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru