SOA-C02 Networking and Content Delivery Practice Question
A company has deployed an Application Load Balancer (ALB) in a VPC. The ALB is configured with a target group pointing to EC2 instances in a private subnet. Clients receive HTTP 503 errors. What is the likely cause?
⚠ Common exam trap
Test-takers frequently confuse HTTP 503 (service unavailable due to no healthy targets) with HTTP 504 (gateway timeout) or assume the issue is with the ALB's own configuration, such as security groups or IP addressing, rather than focusing on the health of the target instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The target instances are unhealthy and the target group has zero healthy hosts.
HTTP 503 errors from an Application Load Balancer indicate that the target group has no healthy registered targets to forward traffic to. When all EC2 instances in the target group are unhealthy (e.g., failing health checks), the ALB cannot route requests, resulting in a 503 response. This is the most common cause of 503 errors in ALB deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ALB does not have an Elastic IP address.
Why it's wrong here
The ALB is an application-layer load balancer that is always accessed via its DNS name rather than an Elastic IP address. Elastic IPs are used for network load balancers or EC2 instances, and not having one does not affect HTTP status codes. A 503 response originates from the ALB after it accepts the request, so the absence of an EIP is irrelevant to the target group's health.
- ✗
The security group for the ALB does not allow inbound HTTP traffic.
Why it's wrong here
If the ALB's security group blocked inbound HTTP traffic, clients would be unable to establish a TCP connection to the load balancer, resulting in a connection timeout or a 504 Gateway Timeout error from upstream proxies, not a 503. The ALB itself generates the 503 error only after successfully receiving the HTTP request and then determining that no targets are available to handle it. Thus, the fact that you received a 503 proves that the ALB's security group is allowing HTTP traffic.
- ✓
The target instances are unhealthy and the target group has zero healthy hosts.
Why this is correct
A 503 Service Unavailable response is returned by the ALB when its target group contains zero healthy hosts, meaning all registered target instances have failed their configured health checks. The ALB cannot forward the request to any instance, so it returns 503 to the client. This is the only condition among the options that directly explains the error, as it happens at the ALB's request-routing layer after the listener accepts the traffic.
- ✗
The route table for the private subnet does not have a route to the ALB.
Why it's wrong here
The route table for the private subnet where the target instances reside governs traffic leaving the instances, not traffic arriving at the ALB. The ALB forwards requests to the target instances using its own network interface and routing, so it does not require a route from the private subnet back to the ALB. If routing were misconfigured, you might see asymmetric traffic or response failures, but the ALB would still send the request and would not generate a 503 simply because the subnet lacks a route to it.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.