DevOps Engineer interview question · Most asked
Explain the difference between L4 and L7 load balancers and when to use each.
Summary
An L4 (transport-layer) load balancer forwards TCP/UDP connections based on IPs and ports without understanding the protocol: very fast, protocol-agnostic, preserves end-to-end TLS. An L7 (application-layer) load balancer understands HTTP: it can route by host, path and headers, terminate TLS, rewrite requests, apply WAF rules, and balance individual requests, including HTTP/2 and gRPC streams.
Longer Answer
Use L7 (for example AWS ALB, Envoy, NGINX) for web APIs and microservices needing routing and per-request balancing; use L4 (AWS NLB, HAProxy in TCP mode) for non-HTTP protocols, extreme throughput, static IPs, or when TLS must not be terminated. Related concepts: health checks, connection draining, sticky sessions (avoid when possible), and idle timeouts that must be aligned with application keep-alive settings.
Key Points
- L4: connections, fast, protocol-agnostic.
- L7: HTTP-aware routing, TLS, WAF.
- Per-request balancing needs L7.
- Align health checks and timeouts.
More most-asked DevOps Engineer questions
- Design a CI/CD pipeline for a containerised microservice from commit to production.
- What are DORA metrics, and how would you use them without gaming them?
- How do you handle database schema migrations in an automated deployment pipeline?
- How do you handle secrets in CI/CD pipelines securely?
- What happens when you type a URL into a browser and press Enter?
- Your CI pipeline takes 45 minutes. How would you speed it up?
- How do you secure the CI/CD pipeline itself against supply-chain attacks?
- What does 'build once, deploy many' mean, and why does it matter?