The target group health check path or port is not aligned with the application's actual health endpoint and The instance security group does not allow inbound traffic from the load balancer security group on required ports are correct because the Application Load Balancer will mark targets unhealthy when it cannot successfully query the expected health endpoint or when its traffic is blocked by instance security group rules.

The target group health check path or port is not aligned with the application's actual health endpoint is correct because if the load balancer is probing the wrong URL path or the wrong port it will get failing responses and mark the target unhealthy even though direct requests to the instance on port 8080 succeed. You should verify the target group health check settings match the service health endpoint and port.

The instance security group does not allow inbound traffic from the load balancer security group on required ports is correct because the instance must permit connections from the ALB security group for both the listener port and the health check port. If the instance security group only allows other sources the ALB cannot reach the application and health checks will fail.

Elastic IP addresses must be attached to the EC2 instances when used behind an Application Load Balancer is incorrect because ALBs route to targets using private IP addresses inside the VPC and they do not require instances to have Elastic IPs.

Cross-zone load balancing is disabled on the load balancer is incorrect because cross zone load balancing only affects how traffic is distributed across Availability Zones and it does not prevent health checks from succeeding.

The EBS volumes on the instances were mounted incorrectly is incorrect because the application responds when accessed directly by IP so the instance storage and mounting are unlikely to be the cause of failed health checks.

Full AWS Practitioner Certification Question