An ALB target group shows targets unhealthy — instances run fine and the app answers on port 8080, but health checks fail. What's the FIRST thing to verify?
A.The health check path/protocol/port matches what the app actually serves
Correct. Path/port/protocol mismatch is the classic misconfiguration.
B.The instance IAM role
IAM roles don't affect ALB-to-instance health traffic.
C.The ALB's SSL certificate
Certificate issues break client TLS, not target health (unless HTTPS checks are misconfigured).
D.Route 53 DNS TTLs
DNS affects clients reaching the ALB, not ALB-to-target checks.
Why this answer
The most common cause: the health check is pointed at the wrong port/path/protocol (e.g., checking / on 80 while the app serves /health on 8080). Security groups on the instance are the second check — but verify the check itself first.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Networking Operations practice session.
Practice Networking Operations