An active check sends probes (for example GET /healthz) on a timer; a passive check watches real traffic for errors. After a few failures the backend leaves the rotation.