SOA-C02 Monitoring, Logging, and Remediation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The target instances are unhealthy, causing the ALB to return 503.

  Why this is correct

  When every instance in a target group fails consecutive health checks, the ALB marks them unhealthy and has no target to forward client traffic to. Instead of proxying a 5xx error from an overloaded backend, the load balancer itself responds with 503 Service Unavailable because the service is deemed unreachable. The health check interval and threshold settings determine how quickly an unhealthy target is removed from rotation, but the client sees 503 until at least one target passes.

• ✗

  The SSL certificate on the ALB has expired.

  Why it's wrong here

  An expired SSL certificate on the ALB's HTTPS listener prevents the TLS handshake from completing when a client connects to the load balancer. The client would encounter a certificate validation error, and the ALB would close the connection or return a 502 Bad Gateway during renegotiation, not a 503 Service Unavailable. Furthermore, a 503 is generated at the HTTP application layer after a request is accepted, whereas TLS failure occurs before any HTTP request reaches the load balancer. Thus, an expired certificate cannot produce the observed 503.

• ✗

  The target instances have high CPU utilization.

  Why it's wrong here

  High CPU utilization on the target instances may slow application responses and cause increased latency, but it does not inherently make an instance unhealthy for the ALB unless the health check endpoint becomes unresponsive or returns an error. Even a severely overloaded instance can continue to pass TCP or HTTP health checks, allowing the ALB to route traffic to it and return status codes like 200 or 500 from the application. The ALB only returns its own 503 when zero healthy targets exist in the target group, not simply because backend resources are under stress. In fact, sustained high CPU could eventually lead to health check failures, but that indirect effect is not what the question describes.

• ✗

  The security group on the ALB is blocking traffic.

  Why it's wrong here

  A security group attached to the ALB controls inbound traffic from clients to the load balancer's listeners. If that security group blocks clients, the requests never reach the ALB infrastructure, so clients would experience timeouts or connection failures rather than receiving an HTTP 503 response. Moreover, because no request reaches the load balancer, no corresponding entry is written to the ALB access logs, whereas a 503 response always indicates the ALB accepted and processed the request. The symptom described points to a lack of healthy targets downstream, not an upstream access control blockage.

Go deeper

Related to this question