An application running on EC2 instances behind an Application Load Balancer (ALB) experiences intermittent 504 Gateway Timeout errors. The EC2 instances are healthy, and their CPU utilization is low. What is the most likely cause of these 504 errors, specifically related to the ALB configuration?

The ALB's idle timeout is set too low for the application's maximum response time.

The target group's health check interval is too short, causing targets to be deregistered prematurely.

The network ACLs or security groups associated with the EC2 instances are blocking communication from the ALB.

The number of available IP addresses in the subnet for the ALB's ENIs is exhausted.

You are designing a highly available, multi-region architecture using AWS Global Accelerator for a latency-sensitive application. Your application endpoints in each region are Application Load Balancers. To ensure optimal routing and failover across regions, what specific type of listener and target combination should be configured for the Global Accelerator accelerators?

A standard listener with an endpoint group containing ALB ARNs and health checks enabled.

A custom routing listener with target groups pointing to specific instance IPs within the regional ALBs.

A port-mapping listener that directly maps client-side ports to backend service ports on EC2 instances.

A UDP listener with an endpoint group configured for EC2 instance IDs, bypassing ALBs for faster connection.

A Network Load Balancer (NLB) is configured with a target group containing EC2 instances. You notice that traffic is not evenly distributed among all registered healthy targets within the target group, despite cross-zone load balancing being enabled at the NLB level. What could be a specific reason for this uneven distribution when using an NLB?

The client source IP addresses are not diverse enough, and the NLB uses a 5-tuple hash for distribution.

The target group's health check port is misconfigured, causing some instances to appear unhealthy.

The EC2 instances have different instance types, leading to varying processing capabilities.

The target group has stickiness enabled, causing requests from the same client to go to the same target.

You have an Application Load Balancer (ALB) that serves multiple microservices using path-based routing. Each microservice has its own target group. A new security requirement dictates that all traffic to a specific microservice's path (e.g., /api/v2/*) must originate from a trusted IP range and also require specific HTTP headers. How would you configure this most effectively on the ALB?

Attach AWS WAF to the ALB and create rules to filter by IP address and HTTP header for the specific path.

Use a Lambda function as a target for the /api/v2/* path to implement custom authorization logic.

Configure listener rules to check for both IP address and HTTP header conditions before forwarding traffic.

Implement IP address filtering in security groups for the EC2 instances, and HTTP header validation in the application code.

A company is migrating a legacy application to AWS. The application uses UDP for real-time streaming and requires persistent connections based on the client IP address for the duration of the stream. Which AWS Load Balancer type and configuration would best meet these requirements?

Network Load Balancer (NLB) with UDP listeners and target group configured for client IP stickiness.

Application Load Balancer (ALB) with UDP listeners and cookie-based stickiness enabled.

Classic Load Balancer (CLB) with UDP listeners and source IP-based stickiness enabled.

Gateway Load Balancer (GLB) with UDP listeners and a target group configured for flow-based stickiness.

You are troubleshooting a performance issue where an Application Load Balancer (ALB) occasionally rejects new connections, even though the backend EC2 instances appear healthy and underutilized. CloudWatch metrics show that the `NewConnectionCount` is high, and the `HealthyHostCount` is stable. Which ALB metric should you investigate to diagnose the connection rejections?

`ClientTLSNegotiationErrorCount`

An Application Load Balancer (ALB) is configured with multiple target groups, each associated with a specific microservice. You need to implement a blue/green deployment strategy such that new application versions are initially routed only 10% of production traffic, with the ability to gradually increase or decrease this percentage without downtime. How would you achieve this with an ALB?

Configure a listener rule with weighted target groups, distributing traffic based on the desired percentages.

Use AWS Route 53 with weighted routing policies pointing to different ALBs for blue and green environments.

Modify the target group associated with the existing listener rule to switch between blue and green instances.

Utilize a custom Lambda@Edge function to dynamically route requests based on a percentage in runtime.

A private application running in a VPC needs to be accessible only by other services within the same VPC and connected VPCs (via VPC peering or Transit Gateway), without exposing it to the internet. The application must also leverage advanced HTTP routing features. Which combination of AWS services would you use?

An internal Application Load Balancer (ALB) configured within the VPC.

A public Application Load Balancer (ALB) behind AWS PrivateLink.

A Network Load Balancer (NLB) with private subnets and a direct connect gateway.

A Classic Load Balancer (CLB) in private subnets with VPC endpoints.

Consider a scenario where an Application Load Balancer (ALB) is deployed in multiple Availability Zones (AZs). You have backend EC2 instances registered in a target group, but they are only provisioned in a single AZ to save costs. If cross-zone load balancing is disabled on the ALB, what is the consequence for client requests routed to the ALB's other AZs?

Requests hitting an ALB node in an AZ with no registered healthy targets will fail with an HTTP 503 error.

Requests will automatically be routed to an ALB node in the AZ containing healthy targets without additional configuration.

The ALB will automatically provision new EC2 instances in the other AZs to handle the traffic.

The ALB will forward all traffic to the single AZ containing the healthy targets, but with increased latency.

Which of the following statements correctly describes a key difference in how Network Load Balancers (NLB) and Application Load Balancers (ALB) handle TLS/SSL termination and re-encryption to backend targets?

ALBs can terminate TLS at the load balancer and optionally re-encrypt to targets, while NLBs require TLS termination on the targets themselves if using TCP listeners.

NLBs can terminate TLS and re-encrypt traffic to targets, while ALBs can only terminate TLS.

Both NLBs and ALBs always re-encrypt traffic to backend targets if TLS is terminated at the load balancer.

NLBs support TLS termination only for UDP traffic, whereas ALBs support it for TCP traffic.

You are integrating an AWS Lambda function with an Application Load Balancer (ALB). The Lambda function requires specific HTTP request headers (e.g., 'X-Custom-Header') to be present in the request to process it correctly. How would you configure the ALB listener rule to ensure these headers are forwarded to the Lambda target?

ALBs automatically forward all HTTP headers to Lambda targets; no special configuration is needed.

You must configure an HTTP header condition in the listener rule, but the header itself is forwarded by default.

ALBs forward all standard HTTP headers but require a special setting to forward custom HTTP headers to Lambda.

Custom headers are not directly supported for forwarding to Lambda targets from ALBs and must be extracted by a Lambda@Edge function first.

An Application Load Balancer is configured with a target group that uses 'instance' as the target type and is registered with EC2 instances. You want to migrate these targets to use Fargate containers. To minimize downtime during the migration, what is the recommended target type to switch to for the target group?

Change the target group type to 'ip' and register the private IP addresses of the Fargate tasks.

Create a new target group with target type 'lambda' and point it to a Lambda function that proxies to Fargate.

Modify the existing target group to deregister EC2 instances and register Fargate task IDs as targets.

Create a new ALB specifically for Fargate containers and update DNS to shift traffic.

Which of the following scenarios is a compelling use case for a Gateway Load Balancer (GLB)?

Inserting third-party network virtual appliances (e.g., firewalls, IDSs) transparently into a network path.

Distributing inbound internet traffic across web servers for a public-facing application.

Providing high-performance, low-latency load balancing for UDP-based gaming servers.

Managing session stickiness and complex content-based routing for a microservices architecture.

You have an Application Load Balancer (ALB) configured with a mutual TLS (mTLS) listener. The client certificate verification fails, and you want to understand the exact reason for the failure. What is the most effective way to troubleshoot client certificate issues with an ALB mTLS listener?

Check the ALB access logs, which include detailed information about mTLS handshake failures and reasons.

Examine the CloudWatch metrics for `ClientTLSNegotiationErrorCount` for general TLS errors.

Inspect the backend EC2 instance logs for certificate validation errors.

Connect directly to the backend EC2 instances and perform manual SSL handshake tests.

A customer is migrating a critical on-premises application that relies heavily on source IP address preservation from clients to the backend servers for auditing and access control. The application also uses TCP for communication. Which AWS Load Balancer type would be the most suitable choice to preserve the original client IP address?

Network Load Balancer (NLB) using TCP listeners.

Application Load Balancer (ALB) using X-Forwarded-For header.

Classic Load Balancer (CLB) using proxy protocol.

Gateway Load Balancer (GLB) with IP preservation enabled.

AWS Load Balancer Interview Questions — Free MCQ Practice Test

AWS Load Balancer Interview Questions — Free MCQ Practice Test | testpaper.space