Amazon EKS — Load Balancing Practice Questions
Test your understanding of load balancing on Amazon EKS.
Question 1
Which Kubernetes resource triggers the creation of an ALB by the AWS Load Balancer Controller?
- A. Service of type LoadBalancer
- B. Ingress with ingressClassName: alb
- C. Deployment with LoadBalancer annotations
- D. EndpointSlice
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Service of type LoadBalancer creates an NLB (not ALB) via the controller |
| B | Ingress resources with ingressClassName: alb trigger ALB creation |
| C | Deployments don’t create load balancers |
| D | EndpointSlices are internal K8s resources for service discovery |
Question 2
What subnet tag enables internet-facing ALB/NLB creation?
- A.
kubernetes.io/role/internal-elb: 1 - B.
kubernetes.io/role/elb: 1 - C.
kubernetes.io/cluster/my-cluster: owned - D.
aws:eks:cluster-name: my-cluster
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | internal-elb tag marks subnets for internal (private) load balancers |
| B | kubernetes.io/role/elb: 1 marks public subnets for internet-facing load balancers |
| C | This is the cluster ownership tag — required but not sufficient for LB subnet discovery |
| D | This is not a valid EKS subnet tag |
Question 3
What is the recommended target type for the AWS Load Balancer Controller?
- A. instance
- B. ip
- C. lambda
- D. eni
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Instance mode adds an extra hop through kube-proxy |
| B | IP mode routes directly to pod IPs — lower latency and required for Fargate |
| C | Lambda is a valid ALB target but not applicable to EKS pods |
| D | ENI is not a valid target type for the LB controller |
Question 4
How can you share a single ALB across multiple Ingress resources?
- A. Use the same ingressClassName
- B. Use TargetGroupBinding
- C. Use the
alb.ingress.kubernetes.io/group.nameannotation - D. Deploy Ingress resources in the same namespace
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Same ingressClassName still creates separate ALBs per Ingress |
| B | TargetGroupBinding binds existing target groups, not shared ALBs |
| C | group.name annotation groups multiple Ingress resources into a single shared ALB |
| D | Namespace does not affect ALB creation — each Ingress creates its own ALB by default |
Question 5
Which load balancer type supports static IP addresses?
- A. ALB
- B. NLB
- C. CLB (Classic)
- D. Gateway Load Balancer
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | ALB uses dynamic IPs; use AWS Global Accelerator for static IPs with ALB |
| B | NLB supports Elastic IP assignment per AZ for static IP addresses |
| C | CLB does not support Elastic IP assignment |
| D | Gateway Load Balancer is for third-party appliances, not general app routing |
Question 6
What does alb.ingress.kubernetes.io/ssl-redirect: "443" do?
- A. Enables SSL on port 443
- B. Redirects all HTTP traffic to HTTPS on port 443
- C. Creates an NLB listener on port 443
- D. Assigns an ACM certificate to port 443
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | SSL is enabled via the certificate-arn annotation |
| B | This annotation creates a redirect rule that sends HTTP (80) traffic to HTTPS (443) |
| C | This is an ALB annotation, not NLB |
| D | Certificate assignment uses the certificate-arn annotation |
Question 7
What is a TargetGroupBinding used for?
- A. Creating new target groups from Kubernetes
- B. Binding existing AWS target groups to Kubernetes Services
- C. Linking multiple NLBs together
- D. Creating security group rules for load balancers
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | TargetGroupBinding binds existing groups, it doesn’t create them |
| B | TargetGroupBinding connects a pre-existing AWS target group to a K8s Service for endpoint registration |
| C | It operates on target groups, not load balancers directly |
| D | Security group rules can be configured in TGB but that’s not its primary purpose |
Question 8
Which SSL policy provides the highest security for ALB/NLB?
- A. ELBSecurityPolicy-2016-08
- B. ELBSecurityPolicy-TLS-1-2-2017-01
- C. ELBSecurityPolicy-TLS13-1-3-2021-06
- D. ELBSecurityPolicy-FS-1-2-Res-2019-08
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | 2016-08 supports TLS 1.0 — insecure by modern standards |
| B | TLS 1.2 only is secure but doesn’t leverage TLS 1.3 improvements |
| C | TLS 1.3 only provides the strongest encryption and forward secrecy |
| D | Forward secrecy policy but still allows TLS 1.2 |
Question 9
Why should you enable cross-zone load balancing on NLB?
- A. It reduces NLB costs
- B. It prevents traffic from being unevenly distributed when pods aren’t spread equally across AZs
- C. It enables static IP assignment
- D. It improves DNS resolution speed
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Cross-zone load balancing adds data transfer costs between AZs |
| B | Without cross-zone, each NLB node routes only within its AZ — uneven pod distribution leads to hotspots |
| C | Static IPs use Elastic IP allocation, not cross-zone |
| D | DNS resolution is unrelated to cross-zone load balancing |
Question 10
Which Kubernetes resource creates an NLB on EKS?
- A. Ingress with NLB annotation
- B. Service of type ClusterIP
- C. Service of type LoadBalancer with
aws-load-balancer-type: external - D. NetworkPolicy
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Ingress creates an ALB, not NLB |
| B | ClusterIP is internal only — no external load balancer |
| C | Service type LoadBalancer with aws-load-balancer-type: external creates an NLB via the AWS LB Controller |
| D | NetworkPolicy controls pod-to-pod traffic, not load balancing |
