ExamPark
Course menuSOA-C03

Exams / SOA-C03 / Study guide / Load balancer and Route 53 health checks

Load balancer and Route 53 health checks: SOA-C03 study notes and practice questions

What to know about Load balancer and Route 53 health checks for the SOA-C03 exam, from the Reliability and Business Continuity domain (22% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

Health check questions describe targets marked unhealthy (or a failover that didn’t happen) and ask why.

Load balancer health checks

  • Settings: protocol, port, path, interval, timeout, healthy and unhealthy thresholds, and success codes.
  • ALB success codes default to 200. A path that redirects (301/302) or needs authentication (401/403) fails unless you change the codes or the path.
  • Targets must allow health check traffic from the load balancer’s security group.
  • Unhealthy targets get no traffic; with ELB health checks on the Auto Scaling group, they are also replaced.
  • Deregistration delay (connection draining) lets in-flight requests finish before a target is removed.
  • If all targets are unhealthy, an ALB fails open and sends traffic to all of them.
  • Watch HealthyHostCount, UnHealthyHostCount, HTTPCode_Target_5XX_Count and HTTPCode_ELB_5XX_Count.

Route 53 health checks

Type Checks
Endpoint An IP address or domain over HTTP, HTTPS or TCP, from health checkers around the world; optional string matching
Calculated Combines other health checks (for example, healthy if 2 of 3 are healthy)
CloudWatch alarm Follows an alarm’s state; the way to check private resources Route 53 checkers can’t reach
  • Endpoint checkers come from the internet, so the endpoint’s firewall must allow the Route 53 health checker IP ranges.
  • On alias records, Evaluate Target Health uses the target’s health (such as an ALB with no healthy targets) without a separate check.
  • Health checks drive failover, multivalue, weighted and latency routing.

Common traps

  • Health check path redirects to HTTPS and targets show unhealthy: change the path, protocol or success codes.
  • Endpoint health check on a private IP. Use a CloudWatch alarm-based check.
  • Security group blocks the load balancer. Allow its security group on the health check port.

Side by side: ALB vs NLB vs Gateway Load Balancer

Try the 2 practice questions

Practice Load balancer and Route 53 health checksTake the free practice exam

Question 1

Medium ·Link to this question (question 1)

A dental chain moved its patient portal behind an Application Load Balancer.

The target group uses the default health check settings with the path /. The application sends unauthenticated requests to / a 302 redirect to /login.

Every target is marked unhealthy, and the ALB access logs show the health check requests arriving at the instances.

What should a CloudOps engineer do so that healthy targets are reported correctly?

Choose one answer.

  1. A. Raise the healthy threshold count and the health check interval so that targets have more time to answer the checks.
  2. B. Allow inbound traffic from the load balancer's security group in the instances' security group on the application port.
  3. C. Change the health check protocol to TCP so that the load balancer only checks that the application port is open.
  4. D. Change the health check path to a lightweight page, such as /health, that returns HTTP 200.
Show the answer and explanation

Answer: D

Explanation

An ALB marks a target healthy only when the health check response code matches the success codes, which default to 200. A redirect on the health check path fails every check even though the application works. Pointing the check at a page that returns 200, or adding 302 to the success codes, fixes it.

Study

Question 2

Harder ·Link to this question (question 2)

A logistics broker's internal shipment API runs behind an internal Application Load Balancer in private subnets in two Regions.

Internal clients resolve api.corp.example through a Route 53 private hosted zone that has failover records for the two Regions.

The engineer created Route 53 health checks that target the primary load balancer's private IP addresses, but they always report unhealthy.

How should the engineer provide working health checks for the failover records?

Choose one answer.

  1. A. Create an HTTPS health check that targets the internal load balancer's DNS name instead of its private IP addresses.
  2. B. Allow the Route 53 health checker IP address ranges in the internal load balancer's security group on port 443.
  3. C. Replace the failover records with multivalue answer records that return both Regions' addresses to every client.
  4. D. Alarm on the load balancer's HealthyHostCount metric and create a health check that monitors the alarm.
Show the answer and explanation

Answer: D

Explanation

Route 53 health checkers send requests from the internet, so they cannot reach endpoints that have only private IP addresses. For resources inside a VPC, publish a metric that reflects health, alarm on it, and create a health check that follows the alarm state. Failover records in private hosted zones work with these alarm-based health checks.

Study

Want more on Load balancer and Route 53 health checks? The 5 full-length practice sets have 10 more Load balancer and Route 53 health checks questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Load balancer and Route 53 health checks

More Reliability and Business Continuity topics