SOA-C03 practice question: Load balancer and Route 53 health checks (2 of 2)

Reliability and Business Continuity A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A logistics broker's internal shipment API runs behind an internal Application Load Balancer in private subnets in two Regions.

Internal clients resolve api.corp.example through a Route 53 private hosted zone that has failover records for the two Regions.

The engineer created Route 53 health checks that target the primary load balancer's private IP addresses, but they always report unhealthy.

How should the engineer provide working health checks for the failover records?

Choose one answer.

A. Create an HTTPS health check that targets the internal load balancer's DNS name instead of its private IP addresses.
B. Allow the Route 53 health checker IP address ranges in the internal load balancer's security group on port 443.
C. Replace the failover records with multivalue answer records that return both Regions' addresses to every client.
D. Alarm on the load balancer's HealthyHostCount metric and create a health check that monitors the alarm.

Show the answer and explanation

Answer: D

A. Wrong: The internal load balancer's DNS name resolves to private addresses. Route 53 health checkers run on the internet and still cannot reach them. Learn more: Types of Amazon Route 53 health checks (opens in a new tab)
B. Wrong: Security group rules cannot create a route from the internet to private IP addresses. The health checkers would still have no network path to the load balancer. Learn more: Types of Amazon Route 53 health checks (opens in a new tab)
C. Wrong: Multivalue answer records still need health checks to remove unhealthy addresses. Without working checks, clients would keep receiving the failed Region. Learn more: Multivalue answer routing (opens in a new tab)
D. Right: Correct. Route 53 health checkers are outside the VPC and cannot reach private addresses. A health check that follows a CloudWatch alarm works for resources with only private addresses, which suits failover records in private hosted zones. Learn more: Configuring failover in a private hosted zone (opens in a new tab)

Explanation

Route 53 health checkers send requests from the internet, so they cannot reach endpoints that have only private IP addresses. For resources inside a VPC, publish a metric that reflects health, alarm on it, and create a health check that follows the alarm state. Failover records in private hosted zones work with these alarm-based health checks.

SOA-C03 practice question: Load balancer and Route 53 health checks (2 of 2)

Explanation

Study

Keep practicing