DVA-C02 Troubleshooting and Optimization Practice Question
A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB health checks are failing for a few instances, but the instances themselves are running and have healthy application processes. What is the MOST likely cause?
⚠ Common exam trap
Watch out — candidates often assume health check failures are always due to application issues (e.g., process crashes) rather than network-layer misconfigurations like security group rules, especially when the instance appears healthy from within the OS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group for the EC2 instances is not allowing traffic from the ALB.
The ALB health checks are failing despite the instances and application processes being healthy, which indicates a network-level issue. The most likely cause is that the EC2 instances' security group is not allowing inbound traffic from the ALB's security group on the health check port (e.g., HTTP/HTTPS). Without this rule, the ALB cannot reach the health check endpoint, marking the instances as unhealthy and causing intermittent 503 errors when traffic is routed to those instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ALB is not scaled to handle the traffic.
Why it's wrong here
If an Application Load Balancer (ALB) is not scaled sufficiently to handle incoming client traffic, it typically manifests as increased latency or HTTP 503 (Service Unavailable) errors for end-users attempting to access the application. However, the ALB's internal health checks, which originate from the load balancer itself to its registered targets, are relatively lightweight and would generally continue to function. Health check failures specifically indicate an issue with the target instance's responsiveness or network accessibility, not the ALB's capacity for client requests.
- ✓
The security group for the EC2 instances is not allowing traffic from the ALB.
Why this is correct
The security group associated with the EC2 instances acts as a virtual firewall, controlling inbound and outbound traffic. For ALB health checks to succeed, the EC2 instance's security group must have an inbound rule that explicitly permits traffic from the ALB's security group or its private IP range on the health check port. If this rule is missing or misconfigured, the ALB's health check probes will be blocked at the network level, preventing a successful connection and causing the ALB to mark the instance as unhealthy.
- ✗
The DNS resolution via Route53 is misconfigured.
Why it's wrong here
DNS resolution, often managed by Route 53, is responsible for translating a domain name into an IP address, directing client requests to the ALB. A misconfiguration in DNS would prevent client requests from reaching the ALB in the first place, leading to DNS resolution errors or connection timeouts for users. However, DNS settings do not impact the ALB's ability to perform its internal health checks on registered EC2 instances, as these checks are initiated by the ALB itself, independent of its public DNS record.
- ✗
Sticky sessions are not enabled on the ALB.
Why it's wrong here
Sticky sessions, also known as session affinity, are an ALB feature designed to ensure that a client's requests are consistently routed to the same target instance throughout their session. This is crucial for applications that maintain session state on the server. While important for user experience and application functionality, the enablement or disablement of sticky sessions has no direct bearing on the ALB's ability to successfully perform health checks on its registered target instances, as health checks are independent probes of instance availability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.