ALB vs NLB: Application vs Network Load Balancer

Both distribute traffic to targets, but they operate at different network layers — and that single fact drives almost every exam answer. ALB works at layer 7 (HTTP/HTTPS); NLB works at layer 4 (TCP/UDP/TLS passthrough).

Choose ALB when you need…

• Path-, host-, header-, or query-string-based routing (e.g., /api → service A, /img → service B)
• AWS WAF integration for layer-7 attack filtering
• Authentication via OIDC/Cognito at the load balancer
• WebSocket support and container-friendly target groups
• Rich request metrics and access logs

Choose NLB when you need…

• Non-HTTP protocols — TCP, UDP, or TLS passthrough to targets
• Ultra-low latency and millions of requests per second
• Static IP addresses per AZ (NLB supports Elastic IPs; ALB doesn't)
• Preserving client source IPs
• VPC endpoint service (PrivateLink) as a source

Exam shortcuts

'HTTP routing rules, WAF, auth' → ALB. 'Static IPs, UDP, extreme throughput, preserve source IP' → NLB. A third type, Gateway Load Balancer, only appears for inline virtual appliances (firewalls, IDS) — it's rarely the answer for app traffic.