ALB Health Check Failure Due to Network ACL or Security Group
A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?
Quick Answer
The answer is the network ACL for the instance's subnet blocking inbound traffic from the ALB's subnet. This is correct because ALB health checks originate from the ALB’s private IP addresses within the VPC, not from its public IP or the internet; if the subnet’s network ACL does not explicitly allow inbound traffic from the ALB’s subnet CIDR on the health check port, the stateful health check responses will be dropped. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this question tests your understanding of the critical difference between security groups (stateful) and network ACLs (stateless)—a common trap is assuming that allowing traffic in the instance’s security group is sufficient, but you must also verify the subnet’s NACL rules. Remember the memory tip: “Security groups remember, NACLs forget”—security groups automatically allow return traffic, while NACLs require explicit inbound and outbound rules for each direction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.
Network ACLs are stateless, so the subnet's NACL must explicitly allow inbound traffic from the ALB's subnet CIDR. If it does not, health check traffic from the ALB will be blocked. Option B is incorrect because the instance's security group allows inbound traffic from the ALB security group, and security groups are stateful, so return traffic is allowed automatically. Option C is incorrect because the ALB security group does not need an outbound rule; security groups are stateful, and the ALB initiates connections to the instances. Option D is incorrect because the ALB can communicate within the VPC regardless of whether it is in a public subnet; an internet gateway is only needed for internet traffic, not for internal ALB-to-instance traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.
Why this is correct
Network ACLs are stateless; if they deny inbound health check traffic from the ALB subnet, health checks will fail.
- ✗
The instance security group does not allow outbound traffic to the ALB.
Why it's wrong here
Security groups are stateful; inbound rule implicitly allows return traffic.
- ✗
The ALB security group does not allow outbound traffic to the instances.
Why it's wrong here
The ALB security group's outbound rules are not the issue; the instance security group must allow inbound from the ALB.
- ✗
The ALB is in a public subnet without an internet gateway.
Why it's wrong here
The ALB can communicate with instances in private subnets via the VPC; an internet gateway is not required for health checks.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SysOps administrator notices that traffic to an Application Load Balancer (ALB) is being rejected. The ALB has a security group that allows inbound HTTP (80) and HTTPS (443) from 0.0.0.0/0. The target group health checks are failing. What could be the issue?
medium- ✓ A.The target instances' security group does not allow inbound traffic from the ALB security group.
- B.The ALB security group does not allow outbound traffic to the targets.
- C.The ALB’s security group is blocking health check traffic from the targets.
- D.The target instances' security group does not allow inbound HTTP/HTTPS from the internet.
Why A: The issue is that the target instances' security group must allow inbound traffic from the ALB's security group (or the ALB's private IP addresses) for health checks to succeed. The ALB's security group allows inbound from 0.0.0.0/0 on ports 80/443 for client traffic, but health checks are initiated by the ALB to the targets. If the target security group does not permit this traffic, health checks fail. Option A correctly identifies this issue. Option B is incorrect because the ALB's security group does not need to explicitly allow outbound to targets; security groups are stateful. Option C is incorrect because the ALB's security group controls inbound from clients, not inbound to targets. Option D is incorrect because target instances do not need to allow inbound from the internet directly; traffic is forwarded by the ALB.
Variation 2. Refer to the exhibit. A SysOps administrator is troubleshooting connectivity issues for a web application that uses an ALB. The ALB sends health check requests to targets on port 443. The network ACL shown is associated with the target subnet. Based on the exhibit, what is causing the health checks to fail?
medium- ✓ A.The network ACL allows inbound HTTPS (443) from 0.0.0.0/0, which includes the ALB, so this should work. The issue is likely elsewhere.
- B.The network ACL does not allow inbound traffic from the ALB on ephemeral ports.
- C.The network ACL is blocking inbound traffic from the internet, but health checks come from the ALB.
- D.The network ACL does not allow inbound HTTP (port 80) from the ALB.
Why A: The network ACL has an inbound rule (Rule 120) that denies all traffic (protocol -1) after allowing specific ports. However, health checks originate from the ALB's private IP addresses, which are not 0.0.0.0/0? Actually, the ALB's health check traffic comes from the ALB's subnet IPs, which might be in the same VPC or different? The NACL rule 100 allows TCP 443 from 0.0.0.0/0, which should include the ALB's IPs. But the deny rule 120 will block traffic not matching the allow rules. However, health check traffic on port 443 should be allowed by rule 100. The issue might be that the NACL is stateless, and the ephemeral ports for response are not allowed. But the question is about health checks failing. Option B is wrong because the ALB does not send health checks on port 80 unless configured. Option C is wrong because health checks originate from ALB, not internet. Option D is wrong because the NACL allows inbound 443 from 0.0.0.0/0.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.