ANS-C01 Network Design Practice Question
A company runs a critical application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in a VPC. The application experiences unpredictable traffic spikes. The company notices that during peak traffic, the ALB returns 503 errors. The network engineer checks the ALB's CloudWatch metrics and sees that the 'ActiveConnectionCount' is high but 'TargetResponseTime' is low. The ALB's target group is configured with a deregistration delay of 300 seconds. The ALB is internet-facing and uses an SSL/TLS certificate from AWS Certificate Manager. The security group for the ALB allows inbound HTTPS from 0.0.0.0/0. The target instances' security group allows inbound traffic from the ALB's security group. The VPC has a CIDR of 10.0.0.0/16 with public and private subnets. The ALB is in public subnets, and the instances are in private subnets. The route tables for private subnets have a default route to a NAT gateway in the public subnets. The company wants to resolve the 503 errors. What should the network engineer do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the idle timeout setting on the ALB to a higher value.
The 503 errors are likely caused by the ALB reaching its connection limit (e.g., 50,000 concurrent connections). Increasing the idle timeout would keep connections open longer, increasing concurrent connections and worsening the issue. Decreasing the idle timeout would close idle connections faster, reducing concurrency. Alternatively, scaling out the target group or adding more ALBs can distribute the load. None of the provided options are correct; the correct action is to reduce the idle timeout or increase the number of targets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable cross-zone load balancing on the ALB.
Why it's wrong here
Disabling cross-zone load balancing reduces available capacity.
- ✗
Increase the deregistration delay to 600 seconds.
Why it's wrong here
Longer deregistration delay can cause more connections to be held.
- ✓
Increase the idle timeout setting on the ALB to a higher value.
Why this is correct
Higher idle timeout keeps connections alive, reducing connection rate.
- ✗
Move the ALB to private subnets and use a NAT gateway for internet access.
Why it's wrong here
ALB must be in public subnets to be internet-facing.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.