[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"prev-aws-certified-cloudops-engineer-associate-reliability-business-continuity-load-balancing-and-health-checks-elastic-load-balancing-fundamentals-en":4,"next-aws-certified-cloudops-engineer-associate-reliability-business-continuity-load-balancing-and-health-checks-elastic-load-balancing-fundamentals-en":20,"lesson-aws-certified-cloudops-engineer-associate-reliability-business-continuity-load-balancing-and-health-checks-elastic-load-balancing-fundamentals-en":32},null,{"locked":5,"reason":6,"meta":7,"item":3},true,"paywall",{"title":8,"description":9,"isFree":10,"estimatedMinutes":11,"difficulty":12,"learningObjectives":13},"RDS Proxy and Performance Tuning","Fix connection exhaustion with RDS Proxy, recognize the session pinning that quietly cancels its benefit, and pick the right tuning lever when the bottleneck is the instance, the storage, or the queries instead.",false,30,"intermediate",[14,15,16,17,18,19],"Explain why database connections are expensive and how max_connections is derived from instance class memory","Describe how RDS Proxy pools and multiplexes connections, and what borrowing means","Identify the operations that cause session pinning and the metric that detects it","Configure the proxy connection pool settings and know their defaults","Explain how RDS Proxy shortens failover and Blue/Green switchover for applications","Choose between connection pooling, instance resizing, storage changes, parameter tuning, and read offloading for a given bottleneck",{"locked":5,"reason":6,"meta":21,"item":3},{"title":22,"description":23,"isFree":10,"estimatedMinutes":24,"difficulty":12,"learningObjectives":25},"Troubleshooting ELB and Target Health","How to read a target health reason code, the ordered list of causes behind an unhealthy target, the fail-open behavior that hides an outage, and the difference between an ELB error code and a target error code.",28,[26,27,28,29,30,31],"Interpret target health states and reason codes from describe-target-health","Diagnose an unhealthy target by working through security groups, network ACLs, ping path, timeout, and matcher in order","Explain fail-open behavior and predict when a load balancer routes to unhealthy targets","Configure target group health thresholds for DNS failover and routing failover","Distinguish HTTP 502, 503, 504, and 460 by the failure each one describes","Select the CloudWatch metric and statistic that proves a given failure mode",{"locked":10,"reason":3,"meta":33,"item":43},{"title":34,"description":35,"isFree":5,"estimatedMinutes":36,"difficulty":12,"learningObjectives":37},"Elastic Load Balancing Fundamentals","What a load balancer actually is in AWS, how ALB, NLB, and Gateway Load Balancer differ in the routing decision each can make, and the target group settings that decide how traffic reaches your instances.",26,[38,39,40,41,42],"Explain why a load balancer DNS name resolves to several IP addresses and what each one is","Compare Application, Network, and Gateway Load Balancers by OSI layer and by the routing decision each can make","Trace a request through a listener, a listener rule, a target group, and a target","Predict traffic distribution with cross-zone load balancing on and off, and state the default for each load balancer type","Select the target type and target group attributes that a given workload requires",{"id":44,"title":34,"body":45,"description":35,"difficulty":12,"estimatedMinutes":36,"extension":698,"infographics":699,"isFree":5,"learningObjectives":717,"meta":718,"navigation":5,"path":719,"quiz":720,"seo":783,"stem":784,"__hash__":785},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/02-reliability-business-continuity/01-load-balancing-and-health-checks/01-elastic-load-balancing-fundamentals.md",{"type":46,"value":47,"toc":688},"minimark",[48,52,55,60,68,80,117,120,127,130,141,145,148,153,160,171,181,297,300,304,307,325,332,340,355,372,379,383,386,427,436,440,443,449,496,503,514,518,521,524,538,547,561,568,571,575,578,599,619,631,646,649,653,681,684],[49,50,51],"p",{},"A payments API runs on 6 EC2 instances split across 2 Availability Zones. A deploy goes out, one instance comes up with a broken configuration, and for the next 40 minutes about a sixth of all requests return errors. Nobody was paged, because nothing was down. The instance was reachable, it answered on port 8080, and it returned HTTP 500 for every call.",[49,53,54],{},"A load balancer would have pulled that instance out of rotation in under a minute. That is what Elastic Load Balancing does for you: not only spreading requests, but continuously asking every target whether it is fit to receive them, and routing around the ones that are not. This lesson builds the model of how that distribution works. The next one covers what to do when the health check itself is the thing that is broken.",[56,57,59],"h2",{"id":58},"a-load-balancer-is-a-set-of-nodes-not-a-box","A load balancer is a set of nodes, not a box",[49,61,62,63,67],{},"The first thing to unlearn is the picture of a single appliance sitting in front of your fleet. When you enable an Availability Zone for a load balancer, Elastic Load Balancing creates a ",[64,65,66],"strong",{},"load balancer node"," in that zone. Enable 3 zones and you get 3 nodes, each with its own IP address, each able to receive client traffic.",[49,69,70,71,75,76,79],{},"Clients find those nodes through DNS. Your load balancer gets a name such as ",[72,73,74],"code",{},"my-lb-1234567890abcdef.elb.us-east-2.amazonaws.com",", and Amazon DNS answers a query for it with the IP addresses of the nodes. The record carries a ",[64,77,78],{},"time to live of 60 seconds",", which is short on purpose: it lets AWS add nodes as traffic grows, and remove a node whose zone is in trouble, without waiting on client caches.",[81,82,87],"pre",{"className":83,"code":84,"language":85,"meta":86,"style":86},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","dig +short my-lb-1234567890abcdef.elb.us-east-2.amazonaws.com\n3.13.20.147\n18.222.9.88\n","bash","",[72,88,89,105,111],{"__ignoreMap":86},[90,91,94,98,102],"span",{"class":92,"line":93},"line",1,[90,95,97],{"class":96},"sbgvK","dig",[90,99,101],{"class":100},"s_sjI"," +short",[90,103,104],{"class":100}," my-lb-1234567890abcdef.elb.us-east-2.amazonaws.com\n",[90,106,108],{"class":92,"line":107},2,[90,109,110],{"class":96},"3.13.20.147\n",[90,112,114],{"class":92,"line":113},3,[90,115,116],{"class":96},"18.222.9.88\n",[49,118,119],{},"Two consequences follow immediately, and both show up on the exam.",[49,121,122,123,126],{},"First, a load balancer needs subnets in the zones you want it to serve. An ",[64,124,125],{},"Application Load Balancer requires at least 2 Availability Zones","; a Network Load Balancer will run with one, though a single zone gives you no zonal redundancy. If you register targets in a zone you never enabled, those targets get no traffic at all.",[49,128,129],{},"Second, the client picks which node IP address to use. AWS does not steer the choice. So the shape of your traffic depends on how many nodes exist and which targets each node is allowed to reach, which is exactly the cross-zone question later in this lesson.",[49,131,132,133,136,137,140],{},"One more distinction before the types. An ",[64,134,135],{},"internet-facing"," load balancer has nodes with public IP addresses and needs public subnets with a route to an internet gateway. An ",[64,138,139],{},"internal"," load balancer has only private addresses. Both reach their targets over private IP addresses, so your instances never need public IPs to sit behind either one.",[56,142,144],{"id":143},"three-load-balancers-three-depths-of-inspection","Three load balancers, three depths of inspection",[49,146,147],{},"AWS offers 3 current generation load balancers. The temptation is to memorize a feature matrix. The faster model is to ask how deep into the packet each one is allowed to look, because that single fact determines everything it can decide.",[149,150],"infographic",{"alt":151,"slug":152},"Three columns comparing the Application, Network, and Gateway Load Balancers by the layer each inspects and the routing decision that layer makes possible, with a selection cue under each column.","elb-type-decision-boundary",[49,154,155,156,159],{},"An ",[64,157,158],{},"Application Load Balancer"," operates at layer 7. It parses the HTTP request, so it can route on the hostname, the path, a header, the method, a query string parameter, or the source IP. It can also terminate TLS, authenticate users against an identity provider, return a fixed response, and issue a redirect without ever touching a target.",[49,161,162,163,166,167,170],{},"A ",[64,164,165],{},"Network Load Balancer"," operates at layer 4. It never parses HTTP. It picks a target using a ",[64,168,169],{},"flow hash"," over the protocol, source IP and port, destination IP and port, and TCP sequence number, then pins that whole TCP connection to the chosen target for its lifetime. Because it does less per packet, it handles very high connection rates with low added latency, and because it does not need to rewrite anything, it can hand your target the client's real source IP.",[49,172,162,173,176,177,180],{},[64,174,175],{},"Gateway Load Balancer"," operates at layer 3. It listens for all IP packets on all ports and forwards them to virtual appliances, firewalls, intrusion detection systems, deep packet inspection tools, using the ",[64,178,179],{},"GENEVE protocol on port 6081",". Traffic reaches it through a Gateway Load Balancer endpoint that you set as the next hop in a route table, so the appliance fleet becomes a transparent bump in the wire.",[182,183,184,199],"table",{},[185,186,187],"thead",{},[188,189,190,193,195,197],"tr",{},[191,192],"th",{},[191,194,158],{},[191,196,165],{},[191,198,175],{},[200,201,202,217,231,245,259,271,284],"tbody",{},[188,203,204,208,211,214],{},[205,206,207],"td",{},"Layer",[205,209,210],{},"7",[205,212,213],{},"4",[205,215,216],{},"3",[188,218,219,222,225,228],{},[205,220,221],{},"Listener protocols",[205,223,224],{},"HTTP, HTTPS",[205,226,227],{},"TCP, UDP, TLS, TCP_UDP",[205,229,230],{},"all IP traffic",[188,232,233,236,239,242],{},[205,234,235],{},"Target selection",[205,237,238],{},"listener rules, then the target group algorithm",[205,240,241],{},"flow hash, pinned per connection",[205,243,244],{},"flow hash to an appliance",[188,246,247,250,253,256],{},[205,248,249],{},"IP address",[205,251,252],{},"changes as it scales",[205,254,255],{},"1 static IP per zone, Elastic IP supported",[205,257,258],{},"via endpoint",[188,260,261,264,266,269],{},[205,262,263],{},"Health check protocols",[205,265,224],{},[205,267,268],{},"TCP, HTTP, HTTPS",[205,270,268],{},[188,272,273,276,279,282],{},[205,274,275],{},"Cross-zone default",[205,277,278],{},"on at the load balancer, per target group override",[205,280,281],{},"off",[205,283,281],{},[188,285,286,289,292,295],{},[205,287,288],{},"Minimum zones",[205,290,291],{},"2",[205,293,294],{},"1",[205,296,294],{},[49,298,299],{},"The Classic Load Balancer still exists and still appears in older material, but AWS recommends migrating away from it, and SOA-C03 scenarios are built around the current generation.",[56,301,303],{"id":302},"how-an-application-load-balancer-decides-where-a-request-goes","How an Application Load Balancer decides where a request goes",[49,305,306],{},"Four objects sit between a client and an instance, and every ALB troubleshooting question depends on knowing which one owns which decision.",[49,308,162,309,312,313,316,317,320,321,324],{},[64,310,311],{},"listener"," checks for connections on a protocol and port, HTTP or HTTPS, port 1 to 65535. A ",[64,314,315],{},"listener rule"," has a priority, one or more conditions, and one or more actions. A ",[64,318,319],{},"target group"," collects targets that share a protocol, a port, and one set of health check settings. A ",[64,322,323],{},"target"," is the instance, IP address, or Lambda function that finally answers.",[49,326,327,328,331],{},"Walk one request through it. A client sends ",[72,329,330],{},"GET https://shop.example.com/api/orders/1042",". The HTTPS listener on port 443 terminates TLS using the ACM certificate attached to it. It then evaluates its rules in priority order, lowest number first:",[81,333,338],{"className":334,"code":336,"language":337},[335],"language-text","priority 10   IF path-pattern = /api/*        THEN forward to tg-api\npriority 20   IF host-header  = img.example.com THEN forward to tg-images\ndefault       (cannot be deleted)             forward to tg-web\n","text",[72,339,336],{"__ignoreMap":86},[49,341,342,343,346,347,350,351,354],{},"Rule 10 matches, so the request goes to ",[72,344,345],{},"tg-api",". Rules are first-match-wins, and the ",[64,348,349],{},"default rule is always evaluated last"," and cannot be deleted, so it functions as the catch-all. If your new path rule sits at priority 60000 behind a broad ",[72,352,353],{},"/*"," rule at priority 5, it will never fire, and that ordering mistake is a common exam stem.",[49,356,357,359,360,363,364,367,368,371],{},[72,358,345],{}," then picks one target using its routing algorithm and forwards the request over a backend connection, HTTP/1.1 by default. The load balancer adds ",[72,361,362],{},"X-Forwarded-For",", ",[72,365,366],{},"X-Forwarded-Proto",", and ",[72,369,370],{},"X-Forwarded-Port"," so the application can still see who the client was, since at layer 7 the packet the target receives comes from the load balancer, not from the client.",[49,373,374,375,378],{},"Two settings on this path are worth committing to memory. The ",[64,376,377],{},"connection idle timeout defaults to 60 seconds"," and can be set anywhere from 1 to 4000. And the load balancer allows 10 seconds to establish a TCP connection to a target before it gives up. Both of those numbers become error codes in the next lesson.",[56,380,382],{"id":381},"target-types-what-you-register-decides-what-you-can-reach","Target types: what you register decides what you can reach",[49,384,385],{},"A target group has one target type, chosen at creation and never changeable afterwards.",[387,388,389,398,419],"ul",{},[390,391,392,397],"li",{},[64,393,394],{},[72,395,396],{},"instance"," registers by instance ID. Traffic goes to the primary private IP of the primary network interface. Simple, and it is what an Auto Scaling group attaches to automatically. It cannot reach instances in a peered VPC.",[390,399,400,405,406,363,409,363,412,367,415,418],{},[64,401,402],{},[72,403,404],{},"ip"," registers by IP address. Allowed ranges are the target group VPC subnets plus ",[72,407,408],{},"10.0.0.0/8",[72,410,411],{},"100.64.0.0/10",[72,413,414],{},"172.16.0.0/12",[72,416,417],{},"192.168.0.0/16",". Publicly routable addresses are rejected. This is how you reach a peered VPC, a database, or an on-premises server over Direct Connect or Site-to-Site VPN, and it also lets several containers on one instance use the same port.",[390,420,421,426],{},[64,422,423],{},[72,424,425],{},"lambda"," registers a single function, which the load balancer invokes rather than connects to. Request and response bodies are capped at 1 MB.",[49,428,429,430,432,433,435],{},"The tempting mistake is to assume ",[72,431,396],{}," is always the safe default. It is the one target type that cannot cross a VPC peering boundary, so any hybrid or multi-VPC scenario points at ",[72,434,404],{},".",[56,437,439],{"id":438},"how-a-network-load-balancer-decides-and-why-client-ip-matters","How a Network Load Balancer decides, and why client IP matters",[49,441,442],{},"There are no rules to evaluate at layer 4. The node hashes the flow, picks a target, and keeps that connection there. Everything interesting is in the connection handling.",[49,444,445,448],{},[64,446,447],{},"Client IP preservation"," is the setting that surprises people. When it is on, your target sees the client's real source address, which means your security groups must allow the client range, not the load balancer. When it is off, the target sees the private IP of the load balancer node. The defaults are not uniform:",[182,450,451,464],{},[185,452,453],{},[188,454,455,458,461],{},[191,456,457],{},"Target group",[191,459,460],{},"Protocol",[191,462,463],{},"Client IP preservation default",[200,465,466,476,486],{},[188,467,468,470,473],{},[205,469,396],{},[205,471,472],{},"any",[205,474,475],{},"Enabled, cannot be disabled for UDP, TCP_UDP, QUIC, TCP_QUIC",[188,477,478,480,483],{},[205,479,404],{},[205,481,482],{},"UDP, TCP_UDP, QUIC, TCP_QUIC",[205,484,485],{},"Enabled, cannot be disabled",[188,487,488,490,493],{},[205,489,404],{},[205,491,492],{},"TCP, TLS",[205,494,495],{},"Disabled",[49,497,498,499,502],{},"If preservation is off and you still need the caller's address, turn on ",[64,500,501],{},"proxy protocol v2",", which prepends a binary header carrying the connection details. Make sure the application can parse it first: a target that chokes on the header will start failing health checks, because the header is added to health check connections too.",[49,504,505,506,509,510,513],{},"The idle timeouts are fixed points worth knowing. TCP flows default to ",[64,507,508],{},"350 seconds"," and can be set from 60 to 6000. TLS listeners are fixed at 350 seconds. UDP flows are fixed at ",[64,511,512],{},"120 seconds",", after which the next packet is treated as a new flow and can land on a different target.",[56,515,517],{"id":516},"cross-zone-load-balancing-with-the-arithmetic","Cross-zone load balancing, with the arithmetic",[49,519,520],{},"This is the single most testable behavior in the topic, and the numbers make it stick better than the definition does.",[49,522,523],{},"Take a load balancer with 2 enabled zones. Availability Zone A holds 2 targets, Availability Zone B holds 8. DNS hands out both node addresses about evenly, so each node receives 50% of client traffic.",[49,525,526,529,530,533,534,537],{},[64,527,528],{},"Cross-zone off."," Each node can only reach targets in its own zone. The node in zone A splits its 50% between 2 targets, so each gets ",[64,531,532],{},"25%",". The node in zone B splits its 50% across 8 targets, so each gets ",[64,535,536],{},"6.25%",". Two targets are doing 4 times the work of the other 8.",[49,539,540,543,544,435],{},[64,541,542],{},"Cross-zone on."," Each node can reach all 10 targets, so every target receives ",[64,545,546],{},"10%",[49,548,549,550,553,554,557,558,560],{},"The defaults differ by type, and the reason is architectural rather than arbitrary. An Application Load Balancer is always cross-zone at the load balancer level and cannot be turned off there, though an individual target group can set ",[72,551,552],{},"load_balancing.cross_zone.enabled"," to ",[72,555,556],{},"false"," and become zonal. Network Load Balancers and Gateway Load Balancers default to ",[64,559,281],{},", which keeps each zone a self-contained failure domain and avoids cross-zone data transfer charges.",[49,562,563,564,567],{},"That charge is the practical catch. Turning cross-zone on for a Network Load Balancer means traffic crosses Availability Zone boundaries, and ",[64,565,566],{},"EC2 data transfer charges apply",". Turning it off means you must plan enough capacity in every zone, because a zone with too few targets will overload them while another zone sits idle.",[49,569,570],{},"There is one trap in the off configuration. When cross-zone is off, an empty or all-unhealthy zone is a real outage for the clients that resolved to it. For an Application Load Balancer this produces HTTP 503 responses for every request entering that zone, which is why AWS warns against creating empty subnets.",[56,572,574],{"id":573},"the-target-group-attributes-that-change-production-behavior","The target group attributes that change production behavior",[49,576,577],{},"Health check settings get their own lesson. These 4 attributes decide how traffic reaches a healthy target, and each one exists to solve a specific failure.",[49,579,580,583,584,587,588,591,592,595,596,598],{},[64,581,582],{},"Deregistration delay"," (",[72,585,586],{},"deregistration_delay.timeout_seconds",", default ",[64,589,590],{},"300"," seconds, range 0 to 3600). When a target is deregistered it enters the ",[72,593,594],{},"draining"," state and stops receiving new requests while in-flight ones finish. If the delay expires while a request is still running, the client gets a 502. If the target has no in-flight requests and no active connections, deregistration completes immediately, though the console keeps showing ",[72,597,594],{}," until the timer runs out.",[49,600,601,583,604,587,607,610,611,614,615,618],{},[64,602,603],{},"Routing algorithm",[72,605,606],{},"load_balancing.algorithm.type",[72,608,609],{},"round_robin","). Round robin assumes similar requests hitting similar targets. ",[64,612,613],{},"Least outstanding requests"," sends each request to the target with the fewest in-progress requests, which is the right answer when request cost or target capacity varies. ",[64,616,617],{},"Weighted random"," distributes randomly and is the only algorithm that supports Automatic Target Weights anomaly mitigation. Neither of the last 2 can be combined with slow start.",[49,620,621,583,624,587,627,630],{},[64,622,623],{},"Slow start",[72,625,626],{},"slow_start.duration_seconds",[64,628,629],{},"0",", meaning disabled, range 30 to 900). A newly healthy target normally receives its full share of traffic the instant it passes one health check. For an application that needs to warm a cache or a JIT compiler, that full share arrives as a wall of latency. Slow start ramps the target up linearly over the configured window instead.",[49,632,633,583,636,587,639,641,642,645],{},[64,634,635],{},"Stickiness",[72,637,638],{},"stickiness.enabled",[72,640,556],{},"). Duration-based stickiness makes the load balancer issue an encrypted ",[72,643,644],{},"AWSALB"," cookie that pins a client to a target; application-based stickiness follows a cookie your application sets. Both are configured per target group, with a duration from 1 second to 7 days. Two constraints catch people out: stickiness requires cross-zone load balancing to be on, and it does not work with the weighted random algorithm.",[49,647,648],{},"It is tempting to treat stickiness as the fix for a session problem. It is a workaround, and it costs you even distribution, because a scale-out event leaves old clients pinned to old targets. The durable fix is to move session state out of the instance, into ElastiCache or DynamoDB, which is where a later topic in this domain picks the thread back up.",[56,650,652],{"id":651},"exam-tips","Exam tips",[387,654,655,658,661,664,667,670,675],{},[390,656,657],{},"\"Route based on URL path or hostname\" is always an Application Load Balancer. \"Static IP address\", \"Elastic IP\", \"millions of requests per second\", or a protocol that is not HTTP points at a Network Load Balancer. \"Firewall appliance\", \"intrusion detection\", or \"third-party inspection\" points at a Gateway Load Balancer.",[390,659,660],{},"\"The targets must terminate TLS themselves\" rules out an HTTPS listener on an ALB. The answer is a Network Load Balancer with a TCP listener on port 443.",[390,662,663],{},"Uneven load across instances with cross-zone in the stem is the 25% versus 6.25% arithmetic. Reach for the target count per zone before reading the options.",[390,665,666],{},"If a question mentions cost as a reason to leave a Network Load Balancer setting alone, it is talking about cross-zone data transfer charges.",[390,668,669],{},"Requests dropped during a deploy point at deregistration delay. New instances slow for their first minute point at slow start. The 2 are opposites and their names do not make that obvious.",[390,671,672,673,435],{},"A target group registered by instance ID cannot reach a peered VPC. If the stem mentions peering, hybrid, or on-premises targets, the target type must be ",[72,674,404],{},[390,676,677,678,680],{},"\"The application needs the client's real IP address\" is ",[72,679,362],{}," on an Application Load Balancer, and client IP preservation or proxy protocol v2 on a Network Load Balancer. Note the default is disabled for TCP and TLS ip target groups.",[49,682,683],{},"The idea worth carrying forward is that a load balancer routes only to targets it believes are healthy, and belief is built entirely from health check settings you chose. Every distribution behavior in this lesson assumes those checks are telling the truth. When they are not, targets go missing from rotation for reasons that have nothing to do with the application, and that is where the next lesson starts.",[685,686,687],"style",{},"html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":86,"searchDepth":113,"depth":113,"links":689},[690,691,692,693,694,695,696,697],{"id":58,"depth":107,"text":59},{"id":143,"depth":107,"text":144},{"id":302,"depth":107,"text":303},{"id":381,"depth":107,"text":382},{"id":438,"depth":107,"text":439},{"id":516,"depth":107,"text":517},{"id":573,"depth":107,"text":574},{"id":651,"depth":107,"text":652},"md",[700],{"slug":152,"concept":701,"style":702,"aspectRatio":703,"labels":704},"A three-column comparison of the current generation load balancers, arranged left to right by how deep into the packet each one looks. Each column shows a single client request entering at the top and the routing decision the load balancer can make on it, drawn as a decision point labeled with the information available at that layer. Column headers carry the OSI layer, the body carries the protocols and the decision, and a footer strip carries the one-line selection cue. The emphasis is that the layer determines the decision, not the other way around.","comparison","16:9",[705,706,707,708,709,710,711,712,713,714,715,716],"Application Load Balancer: layer 7, reads the HTTP request","Protocols: HTTP, HTTPS, gRPC, WebSockets","Decision: host, path, header, method, query string, source IP","Network Load Balancer: layer 4, reads the TCP or UDP connection","Protocols: TCP, UDP, TLS, TCP_UDP","Decision: flow hash over the 5-tuple, same target for the whole connection","Gateway Load Balancer: layer 3, reads the IP packet","Protocols: all IP traffic, GENEVE on port 6081 to the appliances","Decision: flow hash to one appliance, packet returns to its original path","Route by URL or hostname? Application Load Balancer","Need a static IP, extreme throughput, or a non-HTTP protocol? Network Load Balancer","Sending traffic through a firewall or inspection appliance? Gateway Load Balancer",[38,39,40,41,42],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/02-reliability-business-continuity/01-load-balancing-and-health-checks/01-elastic-load-balancing-fundamentals",{"passingScore":721,"questions":722},70,[723,732,742,750,758,764,769,775],{"question":724,"type":725,"options":726,"correctAnswer":728,"explanation":731},"A team runs 2 EC2 targets in Availability Zone A and 8 in Availability Zone B behind a Network Load Balancer with default settings. Roughly what share of client traffic does each target in Availability Zone A receive?","single",[727,728,729,730],"10%, because the load balancer spreads traffic evenly across all 10 targets","25%, because each zonal node receives half the traffic and splits it between the 2 local targets","50%, because clients prefer the zone with fewer targets","6.25%, because the load balancer weights by target count","Cross-zone load balancing is off by default on a Network Load Balancer, so each zonal node serves only the targets in its own zone. DNS hands out both node addresses about evenly, so each node gets 50% of traffic: the 2 targets in zone A split it 25% each while the 8 targets in zone B get 6.25% each. Turning cross-zone on would give all 10 targets 10%.",{"question":733,"type":734,"options":735,"correctAnswers":740,"explanation":741},"Which statements about cross-zone load balancing are correct? (Choose 2.)","multiple",[736,737,738,739],"Cross-zone load balancing is always on at the load balancer level for an Application Load Balancer and cannot be turned off there","Enabling cross-zone load balancing on a Network Load Balancer can add EC2 data transfer charges","Cross-zone load balancing is on by default for Network Load Balancers","An Application Load Balancer target group cannot override the load balancer cross-zone setting",[736,737],"An Application Load Balancer is always cross-zone at the load balancer level, but an individual target group can set the attribute to false and become zonal. Network Load Balancers default to off, and turning it on means traffic crosses Availability Zone boundaries, which is billable data transfer.",{"question":743,"type":725,"options":744,"correctAnswer":747,"explanation":749},"An application needs a fixed IP address that partners can add to their firewall allow lists, and it terminates TLS on the instances themselves. Which load balancer fits?",[745,746,747,748],"Application Load Balancer with an HTTPS listener","Gateway Load Balancer with an appliance target group","Network Load Balancer with a TCP listener on port 443","Application Load Balancer with the host header preservation attribute enabled","A Network Load Balancer gets one static IP per enabled Availability Zone, and you can attach your own Elastic IP addresses, which is what an allow list needs. A TCP listener passes the encrypted bytes straight through so the instance does the TLS handshake. An Application Load Balancer changes IP addresses as it scales and would have to terminate TLS itself to read the request.",{"question":751,"type":725,"options":752,"correctAnswer":756,"explanation":757},"An Application Load Balancer has a listener rule with priority 10 forwarding /api/* to the api target group, and a default action forwarding everything to the web target group. A request arrives for /api/orders. What happens?",[753,754,755,756],"The default action wins, because default actions are evaluated first","The request is rejected with a 404 because no rule matches exactly","Both target groups receive a copy of the request","Rule 10 matches, so the request goes to the api target group","Listener rules are evaluated in priority order, lowest number first, and the first match wins. The default rule cannot be deleted and is always performed last, so it catches only requests that no other rule matched.",{"question":759,"type":725,"options":760,"correctAnswer":761,"explanation":763},"True or False: registering targets by IP address lets you send traffic to an on-premises server reached over Direct Connect.",[761,762],"True","False","The ip target type accepts addresses from the target group VPC subnets plus the RFC 1918 and RFC 6598 private ranges, which covers peered VPCs and on-premises resources reached over Direct Connect or Site-to-Site VPN. Publicly routable addresses are rejected, and instance IDs only work for instances in the load balancer VPC.",{"question":765,"type":725,"options":766,"correctAnswer":586,"explanation":768},"A deployment terminates instances as soon as the Auto Scaling group replaces them, and users report occasional broken uploads. Which target group attribute addresses this directly?",[626,767,586,606],"stickiness.lb_cookie.duration_seconds","Deregistration delay is the window in which a draining target finishes its in-flight requests before the load balancer marks it unused and the instance can be terminated. The default is 300 seconds and the range is 0 to 3600, so a long upload needs a value that covers it. Slow start solves the opposite problem, a cold target being flooded on arrival.",{"question":770,"type":725,"options":771,"correctAnswer":613,"explanation":774},"Which routing algorithm should a target group use when requests vary widely in cost and the targets vary in capacity?",[613,772,617,773],"Round robin","Flow hash","Least outstanding requests sends each new request to the target currently holding the fewest in-progress requests, which naturally steers work away from a slow or busy target. Round robin assumes similar requests and similar targets, and flow hash is the Network Load Balancer mechanism, not an Application Load Balancer option. Note that least outstanding requests cannot be combined with slow start.",{"question":776,"type":725,"options":777,"correctAnswer":779,"explanation":782},"What does a Gateway Load Balancer use to exchange traffic with its registered virtual appliances?",[778,779,780,781],"TLS on port 443 with mutual authentication","The GENEVE protocol on port 6081","Proxy protocol v2 over TCP","VXLAN on port 4789","A Gateway Load Balancer encapsulates the original packet in GENEVE on port 6081 so the firewall or inspection appliance sees the traffic unchanged and can return it to its original path. Proxy protocol v2 is how a Network Load Balancer passes client connection details to targets, which is a different problem at a different layer.",{"title":34,"description":35},"courses/aws-certified-cloudops-engineer-associate/en/domains/02-reliability-business-continuity/01-load-balancing-and-health-checks/01-elastic-load-balancing-fundamentals","mZ8WqpElN3ckAAxCkDCSuBQyM36x3eonABbTKM8Nii0"]