An application load balancer works at layer seven, so it can route by host, path or header, terminate TLS, and integrate with a web application firewall, at the cost of a little latency. A network load balancer works at layer four, handles TCP and UDP, gives you static addresses, preserves the client source address, and scales to extreme throughput. Use layer seven for HTTP routing and layer four for non HTTP protocols or when you need static IPs.
Why interviewers ask this
The interviewer wants a clean grasp of the layer distinction and the practical consequences rather than a memorized feature list. They tend to follow up on client IP preservation, TLS termination and health checks, because those details decide real designs. Being able to name a scenario where the cheaper or simpler option is the wrong one shows judgment rather than defaults.
How to structure your answer
- Anchor the difference at the protocol layer.
- List what layer seven buys you and what it costs.
- List what layer four buys you and where it is required.
- Give a concrete selection rule and one edge case.
Example answer
The layer decides everything else. An application load balancer parses HTTP, so it can send one path to one target group and another somewhere else, rewrite and redirect, terminate TLS and sit behind a web application firewall. That parsing costs a small amount of latency and it only speaks HTTP. A network load balancer just forwards flows, so it handles any TCP or UDP protocol, adds almost no latency, gives you static addresses per zone that firewall teams love, and preserves the client source address by default, which the layer seven one only gives you through a forwarded header. My rule is simple: if it is HTTP and I want routing decisions or a firewall in front, layer seven. If it is a database protocol, a game server, MQTT, or a customer needs to allow list a fixed address, layer four. The edge case worth mentioning is that the layer four one does not terminate TLS by default, so if you want end to end encryption to the backend it is a good fit, but then your web application firewall has nowhere to sit.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How do you get the real client IP when terminating TLS at layer seven?
- What are the health check differences between the two?
- How would you handle a workload that needs both HTTP routing and static IPs?
Related cloud engineer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions