DOP-C02 Resilient Cloud Solutions Practice Question

Network Topology

Refer to the exhibit. A DevOps engineer runs the describe-target-health command and receives the output shown. The ALB target group has two instances. One instance is healthy, and the other is unhealthy with a 502 error. What is the most likely cause of the 502 error?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The application running on the instance is not responding correctly or has crashed.

A 502 Bad Gateway error from an ALB indicates that the target (EC2 instance) is not responding correctly or has closed the connection prematurely. This is commonly caused by the application or web server on the instance crashing or being unable to handle the request. Option A is incorrect because security group issues typically lead to connection timeouts (504) or refused connections, not 502. Option C is incorrect because a missing route to the internet gateway would cause network unreachability, resulting in a different error. Option D is incorrect because the health check path returning a 404 would cause the target to fail health checks, not return a 502 during actual traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The security group for the instance does not allow inbound traffic on port 80 from the ALB.
Why it's wrong here
A 502 Bad Gateway is returned only after the ALB successfully establishes a TCP connection and then receives an invalid HTTP response from the target. If the instance security group denies inbound traffic on port 80 from the ALB, the connection request would be dropped, causing health check failures and client-facing connection timeouts (504 or connection refused), not a 502. Security group rules operate at the transport layer, so they cannot directly manifest as a Layer 7 502 error.
✓
The application running on the instance is not responding correctly or has crashed.
Why this is correct
When the ALB forwards a request to a healthy EC2 instance, the target must send a complete, valid HTTP response within the configured timeout. If the application logic crashes, the process closes the socket, or the web server returns a malformed response, the ALB cannot construct a valid HTTP response for the client and surfaces as a 502 Bad Gateway. Thus, a faulty or crashed application is the direct underlying cause of a 502 error.
✗
The instance's route table does not have a route to the internet gateway.
Why it's wrong here
The route table attached to the instance's subnet controls outbound traffic from the instance to the internet, but the ALB communicates with the instance over the VPC network using the instance's private IP without needing an internet gateway. A missing route to an internet gateway might affect the instance's ability to fetch external dependencies, but it would not prevent the ALB from connecting or cause the target to send an invalid HTTP response. Therefore, this networking misconfiguration would produce a connectivity or timeout issue, not a 502.
✗
The health check path is configured to return a 404 status code.
Why it's wrong here
The health check path is a separate request the ALB sends to determine instance liveness; a 404 response from that path means the health check receives an HTTP status code it does not expect, causing the target to be marked unhealthy. However, a 404 is a valid HTTP response from the application and, if the health check path overlaps with normal traffic, it could even be intentional. When a target is unhealthy, the ALB returns a 503 Service Unavailable to clients, not a 502, so a 404 on the health check path does not directly generate a Bad Gateway error.

Go deeper

DOP-C02 Resilient Cloud Solutions Practice Question

Why each option matters

Option-by-option breakdown

Related to this question