Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solution Architect Associate > ELB > Flashcards

ELB Flashcards

This deck aims to help retain concepts related to the AWS ELB service.

1
Q

Which AWS service automatically distributes incoming application traffic across multiple targets and virtual appliances, both in AWS and on-premises environments?

A

The Elastic Load Balancer (ELB) abstracts customer traffic from infrastructure, allowing each tier to scale independently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the different types of Elastic Load Balancers offered by AWS?

A
  • Application Load Balancer (ALB)
  • Network Load Balancer (NLB)
  • Gateway Load Balancer (GLB)
  • Classic Load Balancer (CLB) (deprecated)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the primary considerations when configuring an ELB in AWS?

A
  • Configured to operate in 2 or more AZs
  • 1 or more ELB nodes are placed into a subnet in each AZ, and scale with load
  • Configured with an (A) record DNS name resolved to ELB nodes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How many IP addresses does an ELB require to operate?

A

ELB requires at least 8 free IP addresses to function and allow for scaling (/28 subnet is sufficient, but /27 or larger is preferred)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the difference between a public-facing and an internal ELB?

A
  • Internet-facing ELB:
    • receives traffic from the internet
    • can route traffic to public and private targets (EC2 instances)
    • ELB nodes have both public and private IP addresses
  • Internal ELB:
    • receives traffic from internal services
    • generally used to separate different application tiers allowing independent scaling
    • ELB nodes have private IP addresses only
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which component of an ELB requires configuration to accept traffic on a specific port/protocol and communicate with targets on a port/protocol?

A

Listeners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What key feature of an ELB ensures that incoming requests are evenly distributed across all registered instances in multiple AZs, enhancing fault tolerance and overall application responsiveness?

A

Cross-zone Load Balancing

Each ELB node in every AZ can evenly distribute traffic to targets in different AZs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why is the Classic Load Balancer (CLB) not recommended for use?

A

Classic Load Balancers do not support Server Name Indication (SNI), requiring a separate CLB for each unique HTTPS name
In contrast, both ALB and NLB support rules, target groups, and host-based rules using SNI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does ALB support an unbroken connection from the customer to the application instance?

A

No, SSL/TLS is always terminated at the ALB

Meaning there is no unbroken SSL connection from the client to the application instance, a new SSL connection is established between the ALB and the application instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the primary features of an ALB?

A
  • Layer 7 load balancer
  • Supports HTTP/HTTPS protocols and can inspect content types, cookies, custom headers, user location, and application behavior
  • Does not support other Layer 7 protocols like SMTP, FTP, etc.
  • Does not support TCP/UDP/TLS listeners
  • Can evaluate application health
  • Requires an SSL certificate for HTTPS
  • Slower due to additional layers in the networking stack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which ALB component handles incoming connection requests based on a specific protocol and port?

A

Listener, which processes and routes incoming requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which ALB component consists of a priority, one or more actions, and one or more conditions?

A

Listener Rule, processed in sequence, with the default rule (catch-all) processed last

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What conditions can be set in a Listener Rule?

A
  • host-header
  • http-header
  • http-request-method
  • path-patterns
  • query-strings
  • source-IP, and others
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What actions can a Listener Rule perform?

A
  • forward
  • redirect
  • fixed-response
  • authenticate-oidc
  • authenticate-cognito
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the primary features of NLB?

A
  • A Layer 4 load balancer (TCP/UDP/TLS/TCP_UDP)
  • No visibility into or understanding of HTTP/HTTPS does not support headers, cookies, or session stickiness
  • Cannot evaluate application health, only performs ICMP checks and basic TCP handshakes
  • Can use static IPs, useful for whitelisting
  • Can forward TCP listeners to application instances, providing an unbroken SSL connection (end-to-end encryption)
  • Extremely fast, handling millions of requests per second with 25% of the latency of an ALB
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When should an NLB be preferred over other types of load balancers?

A
  • When end-to-end encryption (unbroken SSL connection) is required
  • When static IPs for whitelisting are necessary
  • When maximum performance is needed
  • When HTTP or HTTPS is not required
  • When using PrivateLink to provide services to other VPCs

For all other scenarios, use an ALB

16
Q

What options does ELB offer for handling secure connections?

A
  • SSL Bridging (ALB)
  • SSL Pass-Through (NLB)
  • SSL Offload/Termination (ALB)
16
Q

What approach does ELB use for handling secure connections when traffic is decrypted, inspected, and then re-encrypted?

A

SSL Bridging (ALB)

17
Q

What approach does ELB use for handling secure connections when encrypted traffic is passed directly without decryption?

A

SSL Pass-Through (NLB)

18
Q

What approach does ELB use for handling secure connections when traffic is decrypted and then forwarded in plain HTTP without encryption?

A

SSL Offload/Termination (ALB)

19
Q

What are the primary features of SSL Bridging?

A
  • One or more clients make connections to the load balancer
  • The listener is configured for HTTPS
  • The connection is terminated on the load balancer, which requires an SSL certificate for the domain name
  • The load balancer initiates a new SSL connection to the backend instances
  • Instances require SSL certificates and compute resources for cryptographic operations
  • The load balancer requires an SSL certificate to remove the secure layer, access HTTP traffic, and make decisions based on its content before creating a new encrypted SSL session with the backend instances

Negatives: The certificate is stored on the load balancer itself (posing a risk), and EC2 instances also need a copy of the certificate, introducing administrative overhead and the need for compute resources to perform cryptographic operations

20
Q

What are the primary features of SSL Pass-Through?

A
  • The listener is configured for TCP
  • No encryption or decryption occurs on the load balancer
  • The connection is passed directly to the backend instances
  • Each instance must have the appropriate SSL certificate installed
  • There is no exposure of certificates to AWS, as encrypted traffic is passed through the load balancer to the backend instances without intervention
21
Q

What are the primary features of SSL Offload/Termination?

A
  • The listener is configured for HTTPS
  • Connections are terminated on the load balancer, which requires an SSL certificate for the domain name
  • The load balancer initiates non-secure connections to the backend instances using HTTP
  • Traffic from the ELB to the backend instance is never encrypted again
  • Instances do not require an SSL certificate or perform cryptographic operations
22
Q

Which ELB feature enables a load balancer to route requests from a specific client to the same instance for the duration of a user’s session?

A

Sticky Sessions (also known as session affinity or session persistence)

23
Q

What is a good use case for the ELB Sticky Sessions feature?

A

Sticky Sessions are crucial for stateful servers, if user state is stored externally (not on the server), stickiness is not required

24
Q

How does ELB determine which instance to route traffic to when Sticky Sessions are enabled?

A
  • Sticky Sessions generate an AWSELB cookie, which locks the device to a single backend instance for a specified duration (from 1 second to 7 days)
  • Once the cookie expires, the user will be allocated a new cookie with a new backend instance
25
Q

What is the primary function of the GWLB?

A

It helps run and scale third-party appliances such as:
- firewalls
- intrusion detection systems (IDS)
- intrusion prevention systems (IPS)
- data analysis tools
- inbound/outbound transparent traffic inspection/protection tools

26
Q

What type of Load Balancer enables you to deploy, scale, and manage virtual appliances like firewalls, intrusion detection and prevention systems, and deep packet inspection systems?

A

Gateway Load Balancer (GWLB)

27
Q

Which GWLB component operates within a VPC where traffic you want to monitor originates or is destined to, similar to a normal VPC interface endpoint but with the added capability to be included in the route table as the next hop?

A

GWLB Endpoint

28
Q

What are the primary features of the GWLB?

A
  • Load balances packets across multiple backend instances running security software without altering them
  • Uses the GENEVE protocol to create a tunnel between the GWLB and backend instances
  • Manages flow stickiness, ensuring that one flow always uses one appliance
  • Provides an abstraction to enhance resiliency and allows appliances to scale horizontally
29
Q

What might a traffic flow representation look like when using GWLB?

A
  1. Client ->
  2. Internet Gateway (traffic via route table directs the next hop to the GWLB endpoint) ->
  3. GWLB Endpoint ->
  4. GW Load Balancer (balances the load to a range of appliances through the GENEVE tunnel) ->
  5. Security Network Appliance instance ->
  6. GW Load Balancer ->
  7. GWLB Endpoint ->
  8. Application Load Balancer ->
  9. Application instance ->
  10. Application Load Balancer ->
  11. GWLB Endpoint ->
  12. GW Load Balancer ->
  13. GWLB Endpoint ->
  14. Internet Gateway ->
  15. Client

AWS Certified Solution Architect Associate (46 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions