ELB + resilience (ALB, NLB, GWLB)

20 timed scenario questions (~32 min, ~96 sec each). Reinforces night-11-elb-theory.md. Answer without peeking at night-11-quiz-answers.json first.

1. 1.A microservices team runs HTTP APIs on ECS Fargate. They need path-based routing (/orders/* vs /catalog/*), AWS WAF, and OIDC authentication at the load balancer. Which load balancer type fits?

   A.Application Load Balancer — Layer 7 routing, WAF, and auth actionsB.Network Load Balancer — lowest latency for HTTP path-based rulesC.Gateway Load Balancer — distributes HTTP across Fargate task targetsD.Classic Load Balancer — required for ECS service discovery routing

2. 2.A financial app must expose TCP port 443 with a fixed Elastic IP per Availability Zone for partner allowlisting. TLS terminates on the EC2 instances, not the load balancer. Which service should front the fleet?

   A.Application Load Balancer with HTTPS listener and an ACM certificateB.Network Load Balancer with TCP listener — TLS passthrough and EIPC.Gateway Load Balancer with GENEVE listeners to appliance target groupsD.CloudFront distribution configured with a raw TCP origin protocol

3. 3.Security wants all east-west traffic between application tiers to pass through third-party firewall appliances before reaching databases. Appliances run as scaled EC2 instances. Which AWS load balancing service is purpose-built for this?

   A.Application Load Balancer with listener rules per application tierB.Network Load Balancer with Proxy Protocol v2 enabled on the targetsC.Gateway Load Balancer — GENEVE encapsulation to appliance targetsD.Internal Application Load Balancer with AWS WAF REGIONAL rule sets

4. 4.An ALB target group health check uses HTTP on port 8080 path /health. Targets show unhealthy. Curl from a bastion in the VPC to the instance private IP:8080/health returns 200. The instance security group allows inbound 443 from 0.0.0.0/0 but has no rule for port 8080. What is the most likely fix?

   A.Change the health check to TCP-only probes on listener port 443B.Disable cross-zone load balancing on the associated load balancerC.Move targets to a public subnet so health checkers can reach themD.Allow inbound 8080 on the instance SG from the ALB security group

5. 5.You attach an Auto Scaling group to an ALB target group. New instances register as healthy only after the grace period. During the first two minutes after launch, health checks fail while the app boots. What ASG setting addresses this without changing the target group?

   A.Set HealthCheckGracePeriod on the ASG to cover application boot timeB.Increase deregistration delay on the target group to 600 secondsC.Switch the front-end load balancer type from ALB over to Network LBD.Enable sticky sessions on the ALB listener for duration-based cookies

6. 6.Route 53 failover routing uses a primary record pointing to an ALB DNS name. The secondary record points to an S3 static site. What must be configured for automatic failover when the primary app is down?

   A.Weighted routing with equal weights on primary and secondary recordsB.A Route 53 health check on the primary endpoint (or child checks)C.Latency-based routing only — failover works without health checksD.A CNAME from the ALB hostname pointing at the S3 website endpoint

7. 7.A UDP-based telemetry protocol (not HTTP) must be load-balanced across EC2 instances in three AZs with minimal latency. Which load balancer is appropriate?

   A.Application Load Balancer with UDP target groups for telemetryB.Gateway Load Balancer with UDP GENEVE to application targetsC.Network Load Balancer — supports UDP listeners at Layer 4D.Application Load Balancer with WebSocket upgrade for UDP frames

8. 8.During an Auto Scaling scale-in event, the ASG terminates an EC2 instance registered with an ALB target group. In-flight HTTP requests to that instance should complete before the connection is cut. Which setting controls this behavior?

   A.ALB idle timeout alone without changing any target group settingsB.HealthCheckGracePeriod on the Auto Scaling group at instance launchC.Route 53 TTL on the alias record that points at the ALB DNS nameD.Target group deregistration delay (connection draining) setting

9. 9.Fargate tasks in awsvpc mode sit behind an internal ALB. Tasks are in private subnets; the ALB is in public subnets. Which security group pattern is correct?

   A.Task SG: inbound app port from ALB SG; ALB SG: inbound 443 from clientsB.Task SG: inbound 0.0.0.0/0 on app port; no ALB security group neededC.Task SG: outbound only; ALB connects without any inbound SG rules setD.Single shared SG for ALB and tasks with inbound 0.0.0.0/0 everywhere

10. 10.A company compares ALB and NLB cross-zone load balancing defaults. They want to minimize cross-AZ data transfer charges while still having load balancer nodes in every AZ. Which statement is correct?

    A.Both ALB and NLB always force cross-zone on with no disable optionB.ALB has cross-zone on by default; NLB has cross-zone off by defaultC.NLB has cross-zone on by default; ALB has cross-zone off by defaultD.Cross-zone load balancing applies only to Gateway Load Balancer nodes

11. 11.An NLB target group uses TCP health checks on port 8080. Targets are healthy in the console but clients receive connection resets. Application logs show the app listens on 8080 but requires an HTTP GET /ping. What should you change?

    A.Use Gateway Load Balancer health checks instead of the NLB checksB.Disable health checks entirely — NLB does not support target checksC.Switch health check protocol to HTTP with path /ping on port 8080D.Change the NLB listener protocol from TCP to UDP for this application

12. 12.You need Lambda functions as targets for HTTP POST requests from the internet, with path-based routing shared with EC2 targets on the same hostname. Which combination works?

    A.NLB TCP listener forwarding directly to Lambda function ARNs as targetsB.GWLB endpoint invoking Lambda as an inline inspection appliance targetC.Classic Load Balancer with a Lambda plugin for HTTP path-based routingD.ALB listener rule forwarding to a target group with Lambda targets

13. 13.Multi-AZ resilience: An Application Load Balancer serves traffic in us-east-1. One AZ loses power; ALB nodes in the other AZ remain. What happens to new client connections if clients use the ALB DNS name?

    A.Clients resolve to healthy ALB nodes in remaining AZs — ALB is multi-AZB.All client traffic fails until the impaired Availability Zone is restoredC.Route 53 automatically replaces the ALB DNS name with an NLB DNS nameD.Targets in the impaired AZ keep traffic via cross-Region replication

14. 14.A legacy shopping cart stores session state in memory on EC2. Users must stick to the same instance until the session cookie expires. Which ALB feature helps without changing the application?

    A.NLB static IP stickiness based on the destination Elastic IP addressB.Duration-based stickiness using the ALB-generated session cookieC.GWLB flow stickiness keyed by the GENEVE virtual network identifierD.Route 53 geolocation routing pinning users to one backend instance

15. 15.Gateway Load Balancer is deployed with firewall appliances in a dedicated subnet. Application VPCs must send traffic through inspection before reaching the internet. What must exist in each application VPC subnet that routes outbound traffic?

    A.Internet Gateway attachment only on the central appliance subnetB.Application Load Balancer operating in transparent proxy inspection modeC.GWLB endpoint — traffic is redirected to the Gateway Load BalancerD.NAT Gateway placed only inside the central appliance VPC CIDR block

16. 16.An ALB listener rule forwards HTTPS traffic to a target group of Fargate tasks on HTTP port 8080. This pattern is often called:

    A.TLS passthrough — encrypted bytes forwarded unchanged to the targetsB.GENEVE encapsulation applied at Layer 7 for HTTP backend target groupsC.TCP proxy mode identical to Network Load Balancer TLS passthroughD.SSL offloading / TLS termination at the ALB — backends speak HTTP

17. 17.Auto Scaling detects unhealthy instances via the ALB target group. Instances fail health checks and are replaced. Which two components together provide this loop? (Pick the best single answer describing the integration.)

    A.ASG uses ELB health check type; replaces instances marked unhealthy by TGB.CloudWatch alarm on ALB only — ASG never reads target group health statusC.Route 53 health check terminates EC2 instances in the ASG automaticallyD.GWLB marks Auto Scaling group instances for forced retirement events

18. 18.A partner requires your service IP to never change when you replace underlying EC2 instances. The protocol is raw TCP on port 9000, not HTTP. Which architecture satisfies allowlisting?

    A.ALB DNS name — partners allowlist the ALB hostname in their firewallsB.NLB with Elastic IP addresses per AZ — partners allowlist those IPsC.Single EC2 Elastic IP on one instance with no load balancer in frontD.CloudFront distribution in front of raw TCP listeners on port 9000

19. 19.You run an internal-only API: ALB scheme is internal, placed in private subnets. Corporate users reach it via VPN into the VPC. Can you attach a CloudFront-scoped WAF Web ACL directly to this internal ALB?

    A.Yes — WAF CLOUDFRONT scope attaches to any ALB in any AWS RegionB.Yes — internal ALBs use GLOBAL WAF scope instead of REGIONAL scopeC.Use WAF REGIONAL scope on the ALB — CLOUDFRONT scope is CloudFront-onlyD.WAF cannot attach to ALB at all — only API Gateway and CloudFront

20. 20.After a deployment, half of targets in an ALB target group return HTTP 502 to clients. New targets pass health checks but the application log shows "connection refused" from the load balancer nodes only. What is the most likely cause?

    A.Route 53 failover flipped traffic over to the secondary static endpointB.NLB cross-zone load balancing was disabled on a sibling load balancerC.GWLB endpoint is missing from the application VPC subnet route tablesD.Target group traffic port differs from the port the app process listens on