An ALB's targets all register as unhealthy and traffic 503s, though the app runs fine when hit directly. What's the FIRST thing to check?
A.The target group's health check settings — path, port, expected success codes
Correct. Path/port/protocol/matcher config first.
B.Route 53 records
DNS affects name resolution, not target health.
C.The ALB's TLS certificate
TLS affects client→ALB, not ALB→target checks (usually HTTP).
D.NACL ephemeral port rules only
Could matter, but health-check config is the first suspect.
Why this answer
Health-check mismatch is the most common cause: the check hits a wrong path/port or expects 200 while the app returns a redirect/404 — targets fail despite a healthy app. Also verify the target SG allows the health-check port from the ALB's SG.
Correct answer: A · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Networking Operations practice session.
Practice Networking Operations