ANS-C01 Load Balancing and Traffic Management Guide

Load-balancing questions on ANS-C01 are really path-control questions. AWS is testing whether you can place the right control point between clients and targets, match it to the protocol layer, preserve availability across zones or Regions, and avoid breaking inspection or security requirements.

The official task statement for this objective is to design solutions that integrate load balancing to meet high availability, scalability, and security requirements. That is broader than “pick ALB or NLB.” You need to reason about layer 7 application routing, layer 4 transport forwarding, layer 3 appliance insertion, health behavior, target type, client IP requirements, TLS placement, and how the load balancer fits with Route 53, CloudFront, Global Accelerator, WAF, and Gateway Load Balancer endpoints.

What the exam is really testing

If you choose a load balancer before answering those questions, you are usually guessing.

Load balancer chooser

Request path model

Keep the control points separate. Many wrong answers collapse all traffic management into one load balancer.

    flowchart LR
	  C["Client"] --> G["Global layer: Route 53, CloudFront, or Global Accelerator"]
	  G --> L["Regional load balancer: ALB, NLB, or GWLB path"]
	  L --> H["Health and routing decision"]
	  H --> T["Targets or appliances"]
	  T --> O["Logs, metrics, traces, and flow evidence"]

The key exam habit is to ask which layer owns the failing or optimized decision: DNS, edge, regional load balancer, appliance path, target health, or observability.

ALB versus NLB versus GWLB

Do not choose by service popularity. Choose by the protocol and the control point.

Health and failover are part of the design

A load balancer answer is not complete until it explains how unhealthy targets stop receiving traffic and how the path behaves when an Availability Zone, Region, target group, or appliance fleet has a problem.

ANS-C01 often makes more than one answer sound available. Prefer the answer that proves how failure is detected and how traffic moves away from it.

Security placement traps

Load balancing and security are linked, but not interchangeable.

When the prompt says “security,” identify whether it means web filtering, network segmentation, encrypted transport, private exposure, or appliance inspection.

Traffic-management integrations

The exam frequently combines two of these. The strongest answer usually assigns each service one job instead of asking one service to solve the whole path.

Common scenario patterns

Exam eliminations

Troubleshooting order

When a load-balancing scenario describes broken traffic, use this order:

1. Confirm the protocol and listener: HTTP/HTTPS, TCP, UDP, TLS, or all IP packets through an appliance path.
2. Check the target group or appliance target health.
3. Verify subnets, Availability Zones, route tables, and return path.
4. Check security groups, NACLs, endpoint policies, and appliance rules.
5. Confirm DNS, CloudFront, Global Accelerator, or Route 53 behavior if a global layer is involved.
6. Use logs and metrics to prove whether the client reached the load balancer, the target group, and the backend.

This sequence prevents the common mistake of changing security rules before proving the listener, target health, and routing path.

Sample exam question

A company runs a public HTTPS application in two AWS Regions. The application needs host-based routing inside each Region. Global users should connect through static anycast IP addresses, and traffic should move away from a Region quickly if all regional targets become unhealthy. Which design is strongest?

• Use Route 53 simple records that point directly to EC2 instances in both Regions.
• Use CloudFront with a long cache TTL for all requests and no regional load balancer.
• Use AWS Global Accelerator with regional Application Load Balancers as endpoints, and configure the ALBs with host-based listener rules and target health checks.
• Use Gateway Load Balancer as the public entry point and route web requests to firewall appliances only.

Answer: Use Global Accelerator with regional ALBs.

Why: The scenario combines two layers. Static anycast global entry and fast regional movement point to Global Accelerator. Host-based HTTPS routing inside each Region points to ALB. Route 53 simple records do not provide the same static anycast entry or fast endpoint health behavior. CloudFront is not the main answer because the stem emphasizes static IP entry and regional endpoint failover, not HTTP caching. GWLB is for appliance insertion, not normal public web routing.

Fast decision rule

Choose ALB when the decision depends on HTTP. Choose NLB when the decision depends on TCP, UDP, TLS passthrough, static endpoint behavior, or private service publishing. Choose GWLB when the decision is transparent appliance insertion. Add CloudFront, Route 53, Global Accelerator, WAF, or PrivateLink only when their layer has a separate job in the path.

Quiz

Continue with 1.4 Network Observability by Design to make the network path measurable before it fails.