A web application runs on EC2 instances registered to an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The administrator wants a CloudWatch alarm that triggers only when every registered target behind the ALB is unhealthy. Which metric condition should the alarm evaluate?

The correct metric is AWS/ApplicationELB HealthyHostCount <= 0. This metric directly measures the number of healthy targets behind the ALB. Setting the alarm to trigger when this count is less than or equal to zero ensures that the alarm fires only when all registered targets are unhealthy, which is precisely what the administrator wants. AWS/ApplicationELB UnhealthyHostCount = 1 is incorrect because it would trigger if even a single host is unhealthy, not when every host is unhealthy. The AWS/EC2 StatusCheckFailed metrics are incorrect because they monitor the health of the EC2 instances themselves, not their health as perceived by the Application Load Balancer. An instance could pass EC2 status checks but still be considered unhealthy by the ALB due to application-level issues or failed health checks.