SOA-C02 Deployment, Provisioning, and Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure the instance security group to allow traffic from the ALB.

  Why this is correct

  To allow the Application Load Balancer to forward traffic and perform health checks, the instance security group must contain an inbound rule that permits traffic from the ALB's security group or CIDR range on the application's port. If this rule is missing, the ALB's health checks will time out and instances will be marked unhealthy, preventing the ALB from serving requests. Even after the target group ARN is attached, this security group rule is necessary for end-to-end connectivity.

• ✓

  Specify the target group ARN in the Auto Scaling group configuration.

  Why this is correct

  Specifying the target group ARN in the Auto Scaling group's load balancing configuration is what enables automatic instance registration. When new instances launch, the ASG automatically registers them with that target group, and when instances terminate, it deregisters them. Without this ARN, the ALB has no way to know which instances belong to it, even if the launch template is otherwise correct. This is the mandatory step for integrating ASG with an ALB.

• ✗

  Configure health checks on the Auto Scaling group to use ELB.

  Why it's wrong here

  Configuring the Auto Scaling group's health check type to 'ELB' is an optional feature that makes the ASG use the target group's health status for its own scale-in decisions, but it does not itself trigger automatic registration. The registration of instances with the target group is caused exclusively by attaching the target group ARN to the ASG. Additionally, the ELB health check setting only works after the ASG is already associated with a target group, so it cannot be the mechanism that establishes that association.

• ✗

  Create a security group for the ALB and attach it to the Auto Scaling group.

  Why it's wrong here

  Security groups are network access control resources, not load balancer attachments; you cannot attach a security group to an Auto Scaling group. The Auto Scaling group inherits its instance security groups from the launch template, while the ALB has its own independent security group. Creating a security group for the ALB and trying to attach it to the ASG conflates these layers and does nothing to establish the required target group association, so this is not a valid step.

• ✗

  Include the target group ARN in the launch template.

  Why it's wrong here

  The launch template defines the configuration of each EC2 instance, including the AMI, instance type, key pair, block device mappings, and security groups; it has no field for target group ARNs. Target group membership is a load balancing property that the Auto Scaling group manages at the group level, not at the instance template level. Placing a target group ARN in user data or metadata would not cause automatic registration; the ASG's load balancing configuration is the only place where that ARN informs the registration process.

Go deeper

Related to this question