Health checks configuration in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding ELB Health Check Behavior

An AWS Elastic Load Balancer (ELB) is configured with a health check that targets HTTP port 80 and path /status. The health check interval is 30 seconds, with 3 healthy threshold and 2 unhealthy threshold.

If a target instance returns HTTP 500 for 2 consecutive health checks, what will be the ELB's behavior?

A The instance will be marked unhealthy after 2 failed checks and removed from the load balancer.

B The instance will be marked unhealthy only after 3 failed checks and removed from the load balancer.

C The instance will remain healthy because the unhealthy threshold is 2, so it needs 2 successful checks to mark unhealthy.

D The instance will be marked unhealthy immediately after the first failed health check.

💡 Hint

Remember the unhealthy threshold defines how many consecutive failed checks are needed before marking unhealthy.

The unhealthy threshold is 2, meaning the instance must fail 2 consecutive health checks to be marked unhealthy and removed from the load balancer. The healthy threshold of 3 applies to recovering from an unhealthy state and is not relevant here.

❓ Configuration

intermediate

Configuring a Target Group Health Check in AWS ALB

You want to configure an Application Load Balancer (ALB) target group health check to use HTTPS on port 443 and path /health. Which JSON snippet correctly defines this health check configuration?

A {"HealthCheckProtocol": "HTTPS", "HealthCheckPort": "443", "HealthCheckPath": "/health"}

B {"HealthCheckProtocol": "TCP", "HealthCheckPort": "443", "HealthCheckPath": "/health"}

C {"HealthCheckProtocol": "HTTPS", "HealthCheckPort": "80", "HealthCheckPath": "/health"}

D {"HealthCheckProtocol": "HTTP", "HealthCheckPort": "443", "HealthCheckPath": "/health"}

💡 Hint

Check the protocol and port consistency for HTTPS health checks.

For HTTPS health checks, the protocol must be HTTPS and the port must be 443. Option A correctly sets both. Option A uses HTTP protocol on port 443 which is invalid. Option A uses HTTPS protocol but port 80 which is incorrect. Option A uses TCP protocol which does not support HTTP path.

❓ Architecture

advanced

Designing Health Checks for Multi-AZ Auto Scaling Group

You have an Auto Scaling Group (ASG) spanning 3 Availability Zones (AZs) with instances behind an ELB. You want to ensure that unhealthy instances are replaced quickly without affecting availability. Which health check configuration best supports this goal?

A Use only EC2 status checks for health checks and rely on ASG to replace instances after a long grace period.

B Use ELB health checks with a low interval and low unhealthy threshold, combined with ASG health checks set to ELB, to replace instances quickly.

C Disable ELB health checks and use custom scripts on instances to report health to ASG.

D Use ELB health checks with high interval and high unhealthy threshold to avoid false positives.

💡 Hint

Think about combining ELB and ASG health checks for fast detection and replacement.

Using ELB health checks with low interval and low unhealthy threshold allows quick detection of unhealthy instances. Configuring ASG to use ELB health checks ensures ASG replaces instances marked unhealthy by ELB. This combination supports fast replacement without impacting availability across AZs.

❓ security

advanced

Security Implications of Health Check Endpoints

Your web application exposes a health check endpoint /health that returns detailed system status including database connection info. What is the best security practice regarding this health check endpoint?

A Remove the health check endpoint entirely to avoid exposing sensitive information.

B Make the health check endpoint publicly accessible to allow external monitoring services to check status.

C Restrict access to the health check endpoint to only the load balancer IPs using security groups or firewall rules.

D Encrypt the health check response with TLS but allow public access.

💡 Hint

Consider who really needs access to sensitive health information.

Restricting access to the health check endpoint to only trusted sources like load balancer IPs prevents attackers from accessing sensitive system details. Making it public or removing it entirely can cause availability or monitoring issues. TLS encryption alone does not restrict access.

✅ Best Practice

expert

Optimizing Health Check Configuration for Cost and Performance

You manage a fleet of 1000 EC2 instances behind an ELB. Health checks are currently set to run every 10 seconds with a timeout of 5 seconds. This causes high CloudWatch costs and occasional false positives due to network latency spikes. Which health check configuration change best balances cost, performance, and reliability?

A Keep the interval at 10 seconds but reduce timeout to 1 second to reduce cost.

B Decrease the health check interval to 5 seconds and timeout to 2 seconds to detect failures faster.

C Disable health checks and rely on manual monitoring to reduce costs.

D Increase the health check interval to 30 seconds and timeout to 10 seconds, and increase unhealthy threshold to 3.

💡 Hint

Think about how increasing intervals and thresholds affects cost and false positives.

Increasing the interval and timeout reduces the number of health check requests, lowering costs. Increasing the unhealthy threshold reduces false positives caused by transient network issues. Decreasing intervals or disabling health checks either increases cost or reduces reliability.

Practice

1. What is the main purpose of a health check in AWS services like Elastic Load Balancer?

easy

A. To verify if a server or service is responding correctly

B. To increase the server's CPU capacity automatically

C. To backup data from the server regularly

D. To encrypt data sent between servers

Solution

1. Step 1: Understand the role of health checks

   Health checks monitor if a server or service is working properly by sending requests and checking responses.

2. Step 2: Identify the main goal

   The main goal is to detect unhealthy servers so they can be removed from traffic, ensuring reliability.

3. Final Answer:

   To verify if a server or service is responding correctly -> Option A

4. Quick Check:

   Health check purpose = verify server response [OK]

Hint: Health checks confirm server responsiveness, not capacity or backups [OK]

Common Mistakes:

• Confusing health checks with scaling or backup tasks
• Thinking health checks encrypt data
• Assuming health checks improve server hardware

2. Which of the following is the correct way to configure a health check path for an HTTP service in AWS Elastic Load Balancer?

easy

A. HealthCheckInterval: 60

B. HealthCheckPath: "/status"

C. HealthCheckProtocol: TCP

D. HealthCheckPort: 8080

Solution

1. Step 1: Identify the correct parameter for HTTP path

   For HTTP health checks, the path to check is set using HealthCheckPath with a URL path string.

2. Step 2: Differentiate from other parameters

   HealthCheckPort sets the port, HealthCheckProtocol sets the protocol, and HealthCheckInterval sets the time between checks, not the path.

3. Final Answer:

   HealthCheckPath: "/status" -> Option B

4. Quick Check:

   HTTP health check path = HealthCheckPath [OK]

Hint: Path is set with HealthCheckPath, not port or interval [OK]

Common Mistakes:

• Using HealthCheckPort to set the path
• Confusing protocol with path
• Setting interval instead of path

3. Given this health check configuration for a load balancer:
IntervalSeconds: 30
TimeoutSeconds: 5
HealthyThresholdCount: 3
UnhealthyThresholdCount: 2
How many consecutive failed health checks will cause the instance to be marked unhealthy?

medium

A. 30

B. 3

C. 5

D. 2

Solution

1. Step 1: Understand UnhealthyThresholdCount meaning

   This value defines how many failed health checks in a row mark the instance unhealthy.

2. Step 2: Identify the value from configuration

   UnhealthyThresholdCount is set to 2, so after 2 failed checks, the instance is unhealthy.

3. Final Answer:

   2 -> Option D

4. Quick Check:

   Failed checks to unhealthy = UnhealthyThresholdCount = 2 [OK]

Hint: UnhealthyThresholdCount = failed checks before unhealthy [OK]

Common Mistakes:

• Confusing HealthyThresholdCount with unhealthy count
• Using IntervalSeconds as count
• Assuming timeout affects count

4. You configured a health check with TimeoutSeconds set to 10 seconds, but your service responds in 3 seconds. The health check still fails. What is the most likely cause?

medium

A. HealthyThresholdCount is set too low

B. TimeoutSeconds is too high causing failure

C. The health check path is incorrect or unreachable

D. IntervalSeconds is set to 1 second

Solution

1. Step 1: Analyze TimeoutSeconds vs response time

   TimeoutSeconds is 10, service responds in 3 seconds, so timeout is not the issue.

2. Step 2: Consider other causes for failure

   If health check fails despite quick response, likely the path is wrong or the service is unreachable.

3. Final Answer:

   The health check path is incorrect or unreachable -> Option C

4. Quick Check:

   Fast response but failure = wrong path/unreachable [OK]

Hint: Fast response but failure? Check health check path [OK]

Common Mistakes:

• Assuming timeout too high causes failure
• Confusing threshold counts with timeout
• Ignoring path correctness

5. You want to configure a health check for a web service behind an AWS Application Load Balancer. The service sometimes takes up to 8 seconds to respond under load. Which configuration best ensures accurate health status without false failures?

hard

A. Set TimeoutSeconds to 10, IntervalSeconds to 30, HealthyThresholdCount to 3, UnhealthyThresholdCount to 2

B. Set TimeoutSeconds to 5, IntervalSeconds to 10, HealthyThresholdCount to 2, UnhealthyThresholdCount to 2

C. Set TimeoutSeconds to 3, IntervalSeconds to 5, HealthyThresholdCount to 5, UnhealthyThresholdCount to 5

D. Set TimeoutSeconds to 1, IntervalSeconds to 15, HealthyThresholdCount to 1, UnhealthyThresholdCount to 1

Solution

1. Step 1: Match TimeoutSeconds to max response time

   The service can take up to 8 seconds, so TimeoutSeconds should be at least 8 to avoid false failures. Set TimeoutSeconds to 10, IntervalSeconds to 30, HealthyThresholdCount to 3, UnhealthyThresholdCount to 2 sets 10 seconds, which is suitable.

2. Step 2: Choose thresholds and intervals for stability

   Longer IntervalSeconds (30) and thresholds (3 healthy, 2 unhealthy) help avoid flapping due to temporary slow responses.

3. Step 3: Evaluate other options

   Options A, C, and D have TimeoutSeconds too low or thresholds too sensitive, risking false unhealthy marks.

4. Final Answer:

   Set TimeoutSeconds to 10, IntervalSeconds to 30, HealthyThresholdCount to 3, UnhealthyThresholdCount to 2 -> Option A

5. Quick Check:

   Timeout ≥ max response + stable thresholds = Set TimeoutSeconds to 10, IntervalSeconds to 30, HealthyThresholdCount to 3, UnhealthyThresholdCount to 2 [OK]

Hint: Timeout must exceed max response time to avoid false failures [OK]

Common Mistakes:

• Setting TimeoutSeconds less than max response time
• Using too low thresholds causing flapping
• Ignoring service response variability