Health checks configuration in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding ELB Health Check Behavior

An AWS Elastic Load Balancer (ELB) is configured with a health check that targets HTTP port 80 and path /status. The health check interval is 30 seconds, with 3 healthy threshold and 2 unhealthy threshold.

If a target instance returns HTTP 500 for 2 consecutive health checks, what will be the ELB's behavior?

A The instance will be marked unhealthy after 2 failed checks and removed from the load balancer.

B The instance will be marked unhealthy only after 3 failed checks and removed from the load balancer.

C The instance will remain healthy because the unhealthy threshold is 2, so it needs 2 successful checks to mark unhealthy.

D The instance will be marked unhealthy immediately after the first failed health check.

💡 Hint

Remember the unhealthy threshold defines how many consecutive failed checks are needed before marking unhealthy.

The unhealthy threshold is 2, meaning the instance must fail 2 consecutive health checks to be marked unhealthy and removed from the load balancer. The healthy threshold of 3 applies to recovering from an unhealthy state and is not relevant here.

❓ Configuration

intermediate

Configuring a Target Group Health Check in AWS ALB

You want to configure an Application Load Balancer (ALB) target group health check to use HTTPS on port 443 and path /health. Which JSON snippet correctly defines this health check configuration?

A {"HealthCheckProtocol": "HTTPS", "HealthCheckPort": "443", "HealthCheckPath": "/health"}

B {"HealthCheckProtocol": "TCP", "HealthCheckPort": "443", "HealthCheckPath": "/health"}

C {"HealthCheckProtocol": "HTTPS", "HealthCheckPort": "80", "HealthCheckPath": "/health"}

D {"HealthCheckProtocol": "HTTP", "HealthCheckPort": "443", "HealthCheckPath": "/health"}

💡 Hint

Check the protocol and port consistency for HTTPS health checks.

For HTTPS health checks, the protocol must be HTTPS and the port must be 443. Option A correctly sets both. Option A uses HTTP protocol on port 443 which is invalid. Option A uses HTTPS protocol but port 80 which is incorrect. Option A uses TCP protocol which does not support HTTP path.

❓ Architecture

advanced

Designing Health Checks for Multi-AZ Auto Scaling Group

You have an Auto Scaling Group (ASG) spanning 3 Availability Zones (AZs) with instances behind an ELB. You want to ensure that unhealthy instances are replaced quickly without affecting availability. Which health check configuration best supports this goal?

A Use only EC2 status checks for health checks and rely on ASG to replace instances after a long grace period.

B Use ELB health checks with a low interval and low unhealthy threshold, combined with ASG health checks set to ELB, to replace instances quickly.

C Disable ELB health checks and use custom scripts on instances to report health to ASG.

D Use ELB health checks with high interval and high unhealthy threshold to avoid false positives.

💡 Hint

Think about combining ELB and ASG health checks for fast detection and replacement.

Using ELB health checks with low interval and low unhealthy threshold allows quick detection of unhealthy instances. Configuring ASG to use ELB health checks ensures ASG replaces instances marked unhealthy by ELB. This combination supports fast replacement without impacting availability across AZs.

❓ security

advanced

Security Implications of Health Check Endpoints

Your web application exposes a health check endpoint /health that returns detailed system status including database connection info. What is the best security practice regarding this health check endpoint?

A Remove the health check endpoint entirely to avoid exposing sensitive information.

B Make the health check endpoint publicly accessible to allow external monitoring services to check status.

C Restrict access to the health check endpoint to only the load balancer IPs using security groups or firewall rules.

D Encrypt the health check response with TLS but allow public access.

💡 Hint

Consider who really needs access to sensitive health information.

Restricting access to the health check endpoint to only trusted sources like load balancer IPs prevents attackers from accessing sensitive system details. Making it public or removing it entirely can cause availability or monitoring issues. TLS encryption alone does not restrict access.

✅ Best Practice

expert

Optimizing Health Check Configuration for Cost and Performance

You manage a fleet of 1000 EC2 instances behind an ELB. Health checks are currently set to run every 10 seconds with a timeout of 5 seconds. This causes high CloudWatch costs and occasional false positives due to network latency spikes. Which health check configuration change best balances cost, performance, and reliability?

A Keep the interval at 10 seconds but reduce timeout to 1 second to reduce cost.

B Decrease the health check interval to 5 seconds and timeout to 2 seconds to detect failures faster.

C Disable health checks and rely on manual monitoring to reduce costs.

D Increase the health check interval to 30 seconds and timeout to 10 seconds, and increase unhealthy threshold to 3.

💡 Hint

Think about how increasing intervals and thresholds affects cost and false positives.

Increasing the interval and timeout reduces the number of health check requests, lowering costs. Increasing the unhealthy threshold reduces false positives caused by transient network issues. Decreasing intervals or disabling health checks either increases cost or reduces reliability.