DVA-C02 Troubleshooting and Optimization Practice Question
An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The EC2 instances are in an Auto Scaling group. What is the MOST likely cause?
⚠ Common exam trap
Many exam-takers confuse 503 errors with SSL or DNS issues, but 503 specifically indicates the ALB is reachable and functioning but has no healthy targets to serve the request.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The target group health checks are failing.
The intermittent 503 errors indicate that the ALB temporarily has no healthy targets to forward requests to. When target group health checks fail, the ALB marks instances as unhealthy and stops routing traffic to them, causing a 503 response if all instances are unhealthy. This aligns with the Auto Scaling group potentially launching new instances that haven't passed health checks yet, or existing instances failing health checks due to application overload or misconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSL certificate on the ALB has expired.
Why it's wrong here
An expired SSL certificate on the Application Load Balancer (ALB) listener would typically cause client-side browser warnings or connection termination errors, not an HTTP 503. If the ALB were configured to re-encrypt traffic to backend targets and encountered an expired certificate on the target, it would more likely return an HTTP 502 Bad Gateway error. A 502 indicates an issue between the ALB and its registered targets, whereas a 503 specifically implies no healthy targets are available.
- ✓
The target group health checks are failing.
Why this is correct
When all registered instances within an Application Load Balancer (ALB) target group fail their configured health checks, the ALB marks them as unhealthy and stops routing traffic to them. If there are no healthy targets remaining in any associated target group, the ALB cannot fulfill incoming client requests. Consequently, the ALB returns an HTTP 503 Service Unavailable error, indicating that while the load balancer itself is operational, it has no available backend resources to process the request.
- ✗
The ALB DNS name is not resolving.
Why it's wrong here
If the Application Load Balancer (ALB) DNS name is not resolving, clients would be unable to translate the hostname into an IP address, preventing any network connection from being established. This scenario would manifest as a DNS resolution failure or a connection timeout on the client side, rather than an HTTP 503 error returned by the ALB. The ALB itself would remain functional, but unreachable by clients.
- ✗
The security group for the ALB is blocking traffic.
Why it's wrong here
A misconfigured security group for the Application Load Balancer (ALB) that blocks incoming client traffic would prevent TCP connections from being established. Clients attempting to connect would experience connection timeouts or connection refused errors, as their requests would not even reach the ALB to be processed. Therefore, the ALB would not be able to generate and return an HTTP 503 status code, which implies the request was received but could not be serviced by a healthy backend.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. Which TWO steps should be taken to diagnose the issue?
easy- A.Check the Route 53 health checks for the domain.
- ✓ B.Check the CPU utilization of the EC2 instances.
- ✓ C.Check the target group health check settings and instance health status.
- D.Check the security group rules for the ALB.
- E.Check the EBS volume type of the EC2 instances.
Why B: High CPU utilization on EC2 instances can cause them to become unresponsive or fail to respond to health checks within the ALB's configured timeout, leading to 503 errors. The ALB routes traffic only to healthy targets; if instances are overwhelmed, they may fail health checks or drop requests, resulting in a 503 response to clients.
Variation 2. A company runs a Node.js application on Amazon EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. The developer checks the EC2 instance logs and sees no application errors. What is the MOST likely cause?
hard- A.The health check path is set to '/' but the application serves on a different path.
- B.The EC2 instances are running out of memory.
- C.The health check path returns a 5xx status code due to a missing dependency.
- ✓ D.The security group for the EC2 instances does not allow inbound traffic from the ALB.
Why D: When an ALB target group's health checks fail, the ALB will return HTTP 503 (Service Unavailable) errors to clients because there are no healthy targets to route traffic to. If the developer checks the EC2 instance logs and sees no application errors (or no connection attempts at all), it indicates that the health check requests are not even reaching the application. This is typically caused by a security group misconfiguration where the EC2 instances' security group does not allow inbound traffic from the ALB's security group. Option C is incorrect because if the application returned a 5xx status code, the request would have reached the Node.js application, and the error or access attempt would be recorded in the logs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.