AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

A company uses Amazon Route 53 failover routing to direct users to a disaster recovery site when the primary web application becomes unavailable. The primary site is fronted by an HTTPS Application Load Balancer (ALB) that presents an ACM certificate for www.example.com. A Route 53 HTTPS health check is configured against the ALB's DNS name on port 443, but the health check continually reports the endpoint as unhealthy even though users can browse the site successfully. What will most likely make the health check report the endpoint as healthy without adding extra infrastructure or cost?

Move the health check to port 80 and use HTTP instead of HTTPS to avoid SSL validation errors.
Replace the Application Load Balancer with a Network Load Balancer that uses a static IP and retry the health check.
Change the health check protocol to TCP on port 443 to ignore certificate failures.
Edit the Route 53 health check and enable Server Name Indication (SNI) so the host name is included during the TLS handshake.

Report Issue

Answer Description

When an ALB terminates TLS it relies on Server Name Indication (SNI) to determine which certificate to present. A Route 53 HTTPS health check that does not include SNI performs the TLS handshake without a host name, so the ALB returns its default certificate and the health check fails the SSL validation step. Enabling the "Enable SNI" option on the existing health check causes Route 53 to include the Host header (www.example.com) during TLS negotiation. The load balancer now returns the correct ACM certificate and a 200 response, so the health check status changes to healthy. Changing the protocol or port, or switching to TCP health checks, would bypass certificate validation but would not confirm that HTTPS content is served correctly, and replacing the ALB would add unnecessary cost.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.