ANS-C01 practice question 13 of 35

A company deploys a new web application on Amazon EC2 instances. The application runs in private subnets in three Availability Zones behind an…

A company deploys a new web application on Amazon EC2 instances. The application runs in private subnets in three Availability Zones behind an Application Load Balancer (ALB). Security auditors require encryption of all connections. The company uses Amazon Route 53 for DNS and uses AWS Certificate Manager (ACM) to automate SSL/TLS certificate provisioning. SSL/TLS connections are terminated on the ALB. The company tests the application with a single EC2 instance and does not observe any problems. However, after production deployment, users report that they can log in but that they cannot use the application. Every new web request restarts the login process. What should a network engineer do to resolve this issue?

Answer options

A: Modify the ALB listener configuration. Edit the rule that forwards traffic to the target group. Change the rule to enable group-level stickiness. Set the duration to the maximum application session length.

B: Replace the ALB with a Network Load Balancer. Create a TLS listener. Create a new target group with the protocol type set to TLS Register the EC2 instances. Modify the target group configuration by enabling the stickiness attribute.

C: Modify the ALB target group configuration by enabling the stickiness attribute. Use an application- based cookie. Set the duration to the maximum application session length. Correct answer

D: Remove the ALB. Create an Amazon Route 53 rule with a failover routing policy for the application name. Configure ACM to issue certificates for each EC2 instance.

Correct Answer:

C. Modify the ALB target group configuration by enabling the stickiness attribute. Use an application- based cookie. Set the duration to the maximum application session length.

Explanation

The issue described is a loss of session state because subsequent requests from the same user are being routed to different backend EC2 instances. To maintain session integrity for a stateful application, session persistence (stickiness) must be enabled. For an Application Load Balancer (ALB), this is configured on the target group. Enabling stickiness ensures that all requests from a user's session are directed to the same target instance. Using an application-based cookie is a common and effective method for the ALB to track the session.

Why Incorrect

A: Stickiness is an attribute of the target group, not the listener rule. The listener rule's function is to forward traffic based on conditions. B: Replacing an ALB with a Network Load Balancer is an unnecessary and less suitable change, as ALBs are designed for application-layer (HTTP/S) features like cookie-based stickiness. D: Removing the load balancer entirely and using DNS failover does not address the session persistence problem and removes the high availability and scaling benefits of a load balancer.

References

- AWS Documentation, "User Guide for Application Load Balancers", section "Sticky sessions". This section details how to enable stickiness on a target group to bind a user's session to a specific target.

- AWS Documentation, "Elastic Load Balancing User Guide", section "Target groups for your Application Load Balancers", subsection "Target group attributes". This document specifies that stickiness.enabled and stickiness.type are configurable attributes of a target group.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test