SOA-C02 Networking and Content Delivery Practice Question

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 502 errors. The SysOps administrator checks the ALB access logs and sees that the error occurs when the target group has 'unhealthy' targets. What is the MOST likely cause of the 502 errors?

⚠ Common exam trap

The trap here is that candidates may attribute 502 errors to network or capacity issues, but the key clue is 'unhealthy targets' in the logs, pointing directly to health check failures.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The target instances are not passing health checks.

A 502 Bad Gateway error from an ALB occurs when the load balancer cannot successfully forward a request to a healthy target. If the target group has unhealthy targets, the ALB may have no healthy targets to route to, resulting in 502 errors. The most likely cause is that the target instances are failing health checks, so the ALB marks them as unhealthy and cannot serve requests.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The SSL certificate on the ALB is expired.
Why it's wrong here
An expired SSL/TLS certificate on the ALB listener would prevent clients from establishing a secure handshake, causing browser warnings or connection failures before any request reaches the target. The ALB would not generate an HTTP 502 error because the failure occurs at the TLS termination level, not between the load balancer and the target. A 502 specifically signals a communication problem with the backend, not a certificate validity issue.
✗
The ALB does not have enough capacity to handle the traffic.
Why it's wrong here
When an Application Load Balancer reaches its capacity limits, it returns 503 Service Unavailable because it cannot accept or process new client connections. This status occurs when the ALB's scaling resources are exhausted, which is a different failure mode from a 502 Bad Gateway, which indicates a failed connection to a registered target. The ALB automatically scales to handle traffic, so capacity problems are transient, but they never manifest as 502s.
✗
The client request exceeds the idle timeout.
Why it's wrong here
The idle timeout on an ALB is the amount of time the load balancer allows a connection to remain open without any data transfer. If this timeout expires, the ALB closes the connection and returns 408 Request Timeout to the client, not 502 Bad Gateway. A 502 would appear only if the target itself failed to respond or the ALB could not connect to it, which is unrelated to the configured idle timeout value.
✓
The target instances are not passing health checks.
Why this is correct
If the target instances are failing health checks, the ALB will eventually stop routing traffic to them, but while they are in a transitional state or if health checks are misconfigured, the ALB may still attempt to send requests to a non-responsive instance. When the ALB cannot establish a connection or receives no valid response from the target, it returns 502 Bad Gateway. This is one of the most common causes of 502 errors in ALB deployments, especially when targets intermittently fail health checks.

Go deeper

SOA-C02 Networking and Content Delivery Practice Question

Why each option matters

Option-by-option breakdown

Related to this question