A SysOps administrator has configured a Network Load Balancer (NLB) to route custom TCP traffic on port 9000 to a target group of Amazon EC2 instances located in private subnets. The targets are registered by instance ID. Although the application is running on all instances and successfully listening on port 9000, the target group shows all EC2 instances as unhealthy. Which of the following configuration issues could be the cause of the failing health checks? (Select TWO.)
- The security group of the EC2 instances does not permit inbound traffic from the private IP addresses of the NLB nodes on port 9000.Cevap
- BThe route table for the private subnets hosting the EC2 instances is missing a route to an Internet Gateway (IGW).
- CThe Route 53 DNS record for the application is configured with a simple routing policy instead of a failover routing policy.
- The target group health check protocol is set to HTTP, but the application running on the instances only supports raw TCP connections.Cevap
Cevap
The target group health checks are failing because the EC2 instances' security groups do not allow inbound traffic from the private IP addresses of the Network Load Balancer nodes, and the target group is misconfigured to use HTTP health checks for an application that only supports raw TCP traffic.
The correct options identify the security group and protocol mismatch issues. When registering targets by instance ID, the NLB sends health checks from its private IP addresses. The target security groups must explicitly allow this inbound traffic. Additionally, an HTTP health check configuration expects an HTTP response code, which a raw TCP service cannot provide.
Adım Adım Çözüm
Anahtar Kavram
Network Load Balancer health checks require proper security group configuration to allow private IP traffic from NLB nodes, and the health check protocol must match the backend application's capabilities.