Resolve EC2 Health Check Failures with Auto Scaling and CloudWatch Alarms
A company runs a critical web application on AWS. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The Auto Scaling group uses a launch template that specifies an Amazon Linux 2 AMI. The application stores session state in an ElastiCache Redis cluster. Recently, the operations team received alerts that the application is returning 503 errors intermittently. Investigation shows that the ALB target group health checks are failing for some instances, but those instances are still in service. The CloudWatch logs from the instances show that the application is running, but the health check endpoint is timing out after 5 seconds. The health check is configured with a 5-second timeout, 10-second interval, and 2 consecutive successes required to mark healthy. The DevOps engineer suspects that the issue is due to high CPU utilization on the instances causing the health check to respond slowly. The engineer wants to implement a solution that prevents the ALB from routing traffic to instances that are experiencing high CPU, and also automatically scales out to handle the increased load. What should the engineer do?
Quick Answer
The answer is to create a CloudWatch alarm on CPU utilization that performs an EC2 action to stop the instance, and configure the Auto Scaling group with a target tracking scaling policy based on CPU utilization. This solution directly addresses the root cause—high CPU utilization causing the health check endpoint to time out after 5 seconds—by forcibly stopping the overloaded instance, which removes it from the ALB target group and stops traffic routing. The target tracking policy then automatically scales out new instances to handle the increased load, ensuring capacity matches demand without manual intervention. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of how to integrate CloudWatch alarms with EC2 instance actions to remediate health check failures, a common trap being to rely solely on Auto Scaling health checks, which only replace instances after they are marked unhealthy by the load balancer. Memory tip: “Stop the CPU hog, then scale the log”—the alarm stops the bad instance, and the scaling policy adds good ones.
⚠ Common exam trap
Many exam-takers think increasing health check timeout or grace period solves the problem, but AWS expects you to recognize that high CPU instances should be removed from service and replaced via scaling, not just given more time to respond.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.
It addresses both the immediate issue (high CPU causing health check timeouts) and the scaling requirement. Stopping the instance via a CloudWatch alarm removes it from the ALB target group, preventing traffic routing to unhealthy instances. The target tracking scaling policy based on CPU utilization automatically adds instances when CPU is high, ensuring capacity matches demand.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the Auto Scaling group to use ELB health checks and set the health check grace period to 600 seconds.
Why it's wrong here
This delays health checks but does not prevent high CPU instances from being used.
- ✓
Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.
Why this is correct
Stopping high CPU instances removes them from the ALB, and target tracking scaling adds capacity when needed.
- ✗
Create a scheduled scaling action to add more instances during peak hours.
Why it's wrong here
Scheduled scaling does not respond to real-time CPU spikes.
- ✗
Increase the health check timeout to 10 seconds and the interval to 20 seconds to give instances more time to respond.
Why it's wrong here
This would allow slow instances to remain in service longer, potentially worsening the issue.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions should be taken to ensure a highly available and resilient architecture for a critical web application on AWS? (Choose two.)
easy- A.Enable Amazon CloudFront with multiple origins.
- ✓ B.Use an Auto Scaling group to maintain a desired number of instances.
- C.Use a Multi-AZ RDS deployment with read replicas.
- D.Store backups in a different AWS Region.
- ✓ E.Deploy the application across multiple Availability Zones.
Why B: Correct: B and E. Option B ensures that the desired number of EC2 instances is maintained, providing automatic scaling and fault tolerance. Option E deploys the application across multiple Availability Zones, which protects against an AZ failure. Option A (CloudFront) enhances content delivery but does not directly ensure high availability of the web application. Option C (Multi-AZ RDS with read replicas) improves read performance and provides disaster recovery, but write availability depends on the primary instance. Option D (backups in a different region) is for disaster recovery, not for immediate availability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.