AWS Loadbalancers Flashcards

Question

if I need extreme performance LB should I choose NLB or ALB?

Answer 1

NLB as it is not processing the incoming l7 traffic and operating at l4 they can deal with high volumes of traffic.

Answer 2

No ALB only support DSN, you need an NLB for a static IP

Answer 3

No, ALBs do not pass through the connection a NLB is operating at the TCP layer and the encryption will be passed straight through to the host.

Answer 4

You cna use an ALB, it supports authentication of users by OpenID.

Answer 5

You cna use an ALB, it supports authentication of users by OpenID.

Answer 6

- Create a Launch template - Create an autoscaling group and use Launch config - Create an ALB as this works best for our web type workload, we will also as part of this create a target group.

Answer 7

Yes, 100%, each ELB gets deployed as an ENI in the VPC and there is a security group applied to the interface.

Answer 8

No, each LB is deployed in an AZ and depending on the number of AZs and the load, you will get back one IP for each LB making up the ELB.

Answer 9

L4 traffic (L7 traffic is passed through untouched.

Answer 10

You set up the health check to be HTTP, TCP, HTTPS or SSL and the health checker will send out pings to make sure the node is working, If the node is not working it will be taken out of the pool of good node the ELB sends traffic to.

Answer 11

ELB (Hecks are pinged) | EC2 (Checks are on the status of the instance)

Answer 12

HTTPs offload, ALB supports HTTPs offload.

Answer 13

AWS Cert Manager

Answer 14

- Upload - IAM Cert - ACM cert

Answer 15

Instances are terminated and recreated if they fail the health check.

Answer 16

You need to set up a zone in Route53 and create a CNANE record to point to the ELB's URL.

Answer 17

- Lambda | - EKS

Answer 18

They allow you to define, - Redirect to - Forwared to - Return a fixed response - Authenticate

Answer 19

It is where you place a WAF between two LBs

Answer 20

This is where AS adjusts the number of EC2 instances or ECS tasks to ensure the CPU is kept below 75%

Answer 21

This is where ML is used to predict/forecast the required capacity for EC2 and ECS and will adjust resources based on the forecast.

Answer 22

No, you are better to use a finer resolution of 1min, scaling will react faster to changing workload.

Answer 23

- Launch config | - Launch template

Answer 24

You can use spot instances

Answer 25

You can use Auto Scale Group, to scale your workload and use fleet too with reserved and spot.

Answer 26

In AustoScaling you can configure a lifecycle hook, it will pause the instance on start or terminate and triggered a CloudWatch event, with the CW event you can select to take many different actions using services like SNS, Lambda, etc.

Answer 27

Using notifications?

Answer 28

You cna use AutoScaling Lifecycle hooks

Answer 29

You get to create CloudWatch alarms that get triggered by the metrics coming form ASG, this enables you to scale up or down your instances.

Answer 30

This is where we bake in the AMI all software we need.

Answer 31

By default, the autoscaling group will use the EC2 status to understand when it will terminate an instance.

Answer 32

By default, the autoscaling group will use the EC2 status to understand when it will terminate and replace an instance.

Answer 33

This is the amount of time given before health checks start, this enables the software on the EC2 instance to settle.

Answer 34

- Maintain: You maintain x number of instances - Manual: You set what you want - Schedule: You set a period you wnat to have x instances - Dynamic: You respond to the load.

Answer 35

This is a policy that defines how to scale the instances, you have, - Target tracking, scale based on the predefined metric - Simple scaling, - Step scaling,

Answer 36

Put all instance in a scale group across the 3 AZs and reserve 3 instances. The reserved instance will ensure you can spin up instances when needed.

Answer 37

When TLS is terminated on the NLB, the client is preserved.

Answer 38

- ELB request could - CPU - IN bytes - OUT bytes - You can also set up cloudwatch alarms to trigger scaling policy.

Answer 39

You cna use cloudwatch to capture the performance counter, using custom metrics. Set up two clouds what alarms, up and down alarms and have the alarms trigger autoscaling policies in an autoscaling group.

Answer 40

Enable cross AZ

Answer 41

No, the autoscaling group job is to scale, this cna be based on default value such as the CPU, ELB counted requests, bytes in/out.

Answer 42

No, ELBs are created in the AZ used by your application, the number of ELB's depend on the load, AWS scales up as required. You can only use DNS to access the ELB as there are many instances with many addressed, do the DNS 'A' record will contain all the IP's of the ELBs.

Answer 43

ELB used DNS round-robin.

Answer 44

This is where traffic is distributed to the backends evenly across all AZ's

Answer 45

Both support SSL offload

Answer 46

SNI is an extension to the TLS/SSL in 2003 and it enables the browser (client) to add the domain name in the request. This request is used by the server to identify and select the cert to use. In AWS NLB and ALB is used to select the correct cert to use.

Answer 47

- Query string - Header based routing - Method based routing - Host-based routing - Path-based routing - IP/CIDR based routing

Answer 48

Yes, you can use the Lambda as a target for the ALB.

Answer 49

No, privatelink is only supported by NLB.

Answer 50

You can create an NLB and make the NLB available into your customer VPC using privatelink.

Answer 51

Both ELB types support access logs, there can be pushed to S3 and Atena can Quicksight can be used to better understand using Atena queries and a quick sight to visualize.

Answer 52

It means that all request will be completed before deregistering happens.

Answer 53

Host-based routing is when you want to deliver say api.keith.com and www.keith.com to the same server endpoint and have the server route the request to the appropriate app.

Answer 54

This is where you are routing incoming HTTP request based on for example /v1 and sat /v2 to different apps on the webserver.

Answer 55

This is where you are using values in the HTTP header to route incoming HTTP requests, for example, you may have a cookie in the header and you may be rooting based on the cookie.

Answer 56

You have to use an NLB as it can have static IP, this means the IoT device with it hardcoded IP can connect to this static IP.

Answer 57

NLB as it supports the preservation of the source IP, ALB does not.

Answer 58

Yes, ELB support using IP's as a target, this means thet once the AWS ELB can see the ending IP ad in it is public-facing, you can load balance to it.

Answer 59

This is where the ELB will route the incoming request based on the IP or CIDR range.

Answer 60

No ALB supports Amazon EC2 Container Service (ECS) as a target.

Answer 61

HTTP/2 is a new version of the HyperText Transfer Protocol (HTTP) that uses a single, multiplexed connection to allow multiple requests to be sent on the same connection. It also compresses header data before sending it out in binary format and supports SSL connections to clients.

Answer 62

No, NLB does not support IPv6, ALB have support for IPv6.

Answer 63

Using cloud watch.

Answer 64

x-ray is one option, but as this is focused more on ELB, the answer would be 'request tracing'. The Application Load Balancer injects a new custom identifier “X-Amzn-Trace-Id” HTTP header on all requests coming into the load balancer. Request tracing allows you to track a request by its unique ID as the request makes its way across various services that make up your websites and distributed applications. You can use the unique trace identifier to uncover any performance or timing issues in your application stack at the granularity of an individual request

Answer 65

This is a set of instances the ELB is going to route to.

Answer 66

ALB has the ability to enable you to auth users using a number of different methods. OpenID is one such method.

Answer 67

- OpenID - Socail, FB, Google, Amazon, Cognito - SAML - LDAP - Microsoft AD

Answer 68

ALB has the ability to enable you to auth users using a number of different methods. Microsoft AD is one such method.

Answer 69

You can use ELB (ALB, NLB), both support internal VPC support.

Answer 70

You would use Route53 and weighted routing.

Answer 71

A CANONICAL record, this record type points at the ALB DNS name.

Answer 72

ALB supports IPv6 in a dual-stack mode

Answer 73

You can use a security group with the ALB to ensure only 80 and 443 are open.

Answer 74

- Add a new target group to the existing ALB | - Add a new listener rule to split traffic by 50% to a new target group.

Answer 75

- Shield basic is already in place when you use the ALB, you can add shield advance and this will add L7 protection.

Answer 76

You can add a WAF.

Answer 77

Use GuardDuty, GD will analyse the VPC flow logs for threats,

Answer 78

The AWS application load balancer (ALB) can be used with AKS

Answer 79

It is the AutoScaling group, you register the target group with the autoscaling group and it adds the instances to the target.

Answer 80

Yes you can add many certs

Answer 81

No, but an ALB dose?

Answer 82

- Multiplexed requests, the ability to open a single connection and send many requests at the same time.

Answer 83

Use a network load balancer, this is operating at L4 (TCP).

Answer 84

ALB only support DNS, Network load balancer can have static IP's.

Answer 85

- Ultra-low latency - L4 - App need to have direct access by client - Preserving client IP.

Answer 86

No, the connection is terminated at the web application.

Answer 87

ALB is not suitable as it will terminalte the encrypted connection at the ALB, the option is to use an NLB where the conenction is terminated at the server application.

Answer 88

ALB is not suitable as it will terminate the encrypted connection at the ALB, the option is to use an NLB where the connection is terminated at the server application.

Answer 89

Use AMI baking as bootstrapping is slower

Answer 90

Use AMI baking as it bakes in the software and apps and no need to deploy at software and config at boot, unlike bootstrapping that will install and configure the software at boot time.

Answer 91

Create an autoscaling group with a launch configuration where you use spot instances.

Answer 92

You can not change a launch configuration

Answer 93

You can edit a launch template when you do the version id increments and you can reference any of the previous or current version of the launch template.

Answer 94

It is the period of time an autoscaling group will what after instances are launched before health checks are sent to the instance.

Answer 95

It will replace the instance.

Answer 96

They control how the autoscaling group scales, - Step scaling enables you to react more aggressively to larger changes - The simple scaling policy enables you to track say CPU and the ASG will try to add instance to keep the CPU at say 50%

Answer 97

With auto-scaling, you can have scheduled scaling where we can up the number of instances for the time period required.

Answer 98

You can edit the auto-scaling group and set the suspend processes to stop the ASG from changing during the maintenance window.

Answer 99

``` You need to think about two things here, - Capacity when running at normal - Min capacity the app cna run on Answer is, - 9 instances in 3 AZs ```

Answer 100

You have to reserve instance capacity in all 3 AZs as when the auto-scaling group terminates an instance with my not be able to create one without capacity been reserved.

Answer 101

Here you need to focus on again what is the min capacity needed, it is 9 instance but in this case, you need 9 instances s100% of the time and if an AZ was to fail with just 9 instances you would drop below the 9 for a small period and this would not meet the requirement so you have to OVER PROVISION capacity. so 12 instances in 4 AZ's is the correct answer.

Answer 102

Here you need to focus on again what is the min capacity needed, it is 9 instance but in this case, you need 9 instances s100% of the time and if an AZ was to fail with just 9 instances you would drop below the 9 for a small period and this would not meet the requirement so you have to OVER PROVISION capacity. But we also need to look at the lowest cost too, this would be 1 instance in 7 AZs, this way you only have an extra instance over an above the 100% requires. It would also be important to factor in reservation here so in the event of a single instance or Az failure you are guaranteed to be able to restart the instance.

Answer 103

Yes, you used not be able able to terminate at the NLB, this was added as a feature. Also when you terminate at the NLB the IP is preserved.

Answer 104

Yes, when AWS added the ability to terminate TLS at the NLB, they added the ability to keep the client IP.

Answer 105

No, the NLB will preserve the client IP without the need for proxy protocol.

Answer 106

No, you can use the proxy protocol to get the client IP when using classic LB. Also, the classic LB is not recommended to be used by AWS any more.

Answer 107

The proxy protocol is not used with the NLB, it is used with the classic Load balancer. The proxy protocol works by saving the client IP and when the connection is created to the server, the first lines sent to the server is the contains the client IP, it is in ASCII format, looks like this, PROXY TCP4 198.51.100.22 203.0.113.7 35646 80\r\n

Answer 108

Yes, just include a single subnet.

Answer 109

Yes, NLB is an L4 so not special handlines will take place?

Answer 110

Certs can be created or uploaded to IAM or ACM

Answer 111

No, unlike ALB where backend auth is supported.

Answer 112

The LCU metrics for the TCP traffic is as follows: 800 new TCP connections per second. 100,000 active TCP connections (sampled per minute). 1 GB per hour for EC2 instances, containers and IP addresses as targets.

Answer 113

This is possible because of the sticky session is holding the session to the instance for long periods and over time you may get inbalance across instances.

Answer 114

Disable sticky sessions and start using an elastic cache where we session information is not needed by the application on the instance. This way we can now free the LB to distribute the request to any instance.

Answer 115

Request tracing, where the X-Amzn-Trace-Id is automatically added to incoming requests and if access logs are enabled the content of this header is captured.

Answer 116

The NLB is a layer4 load balancer and supports UDP

Answer 117

You can enable ELB deletion protection.

Answer 118

You pay 0.0225 per ALB per month ($16) You pay for the Loadbalancer capacity unity (LCU)

Answer 119

You can use the ELB with IP as a target to send traffic to on-prem through the VPN.

Answer 120

You set up redirects on the routing rules, normally this is forwared but you can also select redirect.

Answer 121

You can use fixed responses.

Answer 122

You can use the ELB slow start feature to delay the ELB form sending traffic to the target.

Answer 123

No, it means HTTP/s arives on the front end for IPv6 but is sent to the backend s IPv4.

Answer 124

ALB supports authentication using social identities, SAML and an IdP. You cna use OICD

Answer 125

ALB supports authentication using social identities, SAML and an IdP. You cna use OECD. This is even better in it integrates with Cognito and where Cognito identity provider pool can be used.

Answer 126

- 25 new connection per second - 3K active connections 2.22mbs (1GB per HR) 1K rules evaluation You are billed for the max of theses

Answer 127

Yes all the load balancers are highly available created um in multiple zones

Answer 128

An AWS Gateway Load Balancer (GWLB) is a powerful, specialized load balancer designed specifically for deploying, scaling, and managing third-party virtual appliances—such as firewalls, intrusion detection and prevention systems (IDPS), deep packet inspection (DPI), or custom traffic inspection tools—in a scalable and transparent way. ✅ What is AWS Gateway Load Balancer? 📘 Definition: AWS Gateway Load Balancer operates at Layer 3 (Network Layer) of the OSI model and provides both: Transparent traffic forwarding using GRETunnels (Generic Routing Encapsulation) Load balancing of traffic across multiple virtual appliances It's essentially a bump-in-the-wire solution—traffic flows through it, is forwarded to a fleet of appliances, and then returned to the network. 🧠 Key Concepts Concept Description GRETunnels Used to forward traffic from GWLB to target appliances. VPC Endpoint Service GWLB works with interface VPC endpoints for cross-VPC deployment. Elasticity Automatically scales virtual appliances up/down based on demand. Health Checks Monitors appliance availability to ensure traffic is only sent to healthy targets. 🔧 Use Cases Security Appliance Insertion: Deploy third-party firewalls, antivirus, or DPI systems between your users and services. Transparent to users and apps. Inline Traffic Inspection: Monitor, filter, or modify traffic before it reaches workloads (e.g., malware scanning, DDoS protection). Multi-VPC Appliance Deployment: Centralize your security tools in one VPC and serve multiple VPCs using VPC endpoints. Load Balancing Network Appliances: Automatically distribute traffic across a fleet of stateful or stateless network appliances. Network Segmentation and Logging: Use appliances to log or audit traffic flows between segmented networks.

Answer 129

yes, the classic load balancer supports both L7 and L4

Answer 130

Server Name Indication (SNI) is an extension to the TLS protocol that allows a client to specify the hostname it’s trying to connect to during the TLS handshake. This enables the AWS Elastic Load Balancer (ELB) to present the correct SSL certificate for the requested domain. It’s particularly useful for hosting multiple secure (HTTPS) applications using different domain names on the same load balancer.

Answer 131

This would be the application load balancer, and it's used when you don't want to use have the user use HTTP but you want to redirect them to HPS

Answer 132

EC2 instances ECS Lambda functions And private IPS

Answer 133

400 milliseconds

Answer 134

100 milliseconds

Answer 135

An AWS Network Load Balancer (NLB) actively forwards the traffic to the registered targets — it does not just give you their IP addresses for you to use manually. Here’s how it works: ✅ What the NLB actually does: When a client sends traffic to the NLB’s static IP or DNS name, the NLB receives the traffic. It then selects a target from the target group (based on a flow hash algorithm). The NLB forwards the TCP (or UDP) traffic directly to the IP address and port of the selected target. It maintains the original source IP address, which is useful for servers needing that info for logging or firewall rules. You do not need to know or handle the target IPs directly. The NLB does the routing/load balancing for you. 💡 Bonus: Target types You can register targets by: Instance ID (NLB will resolve its private IP automatically) IP address (valid for on-prem or container workloads) Lambda (only with ALB, though)

Answer 136

You would use the Gateway load balance from when you want to inspect the traffic in both directions as traffic is uh inspectable in both the Inward and the outward

Answer 137

ec2 instances private IP addresses