How to Balance TCP Port 1028 Across Three EC2 Instances?

SOA-C03 By islever Editorial Last updated Oct 20, 2026

Implement and optimize networking features and connectivity. Implement highly available and resilient environments.

Short answer

B Use a Network Load Balancer with a TCP listener on port 1028 and a target group registering the three EC2 instances across the three AZs.

Question

A company has a new application that runs on three Amazon EC2 instances. The EC2 instances are spread across three Availability Zones in a single AWS Region. The application is accessible on TCP port 1028. The company wants to balance traffic across all the EC2 instances.
Which solution will meet these requirements with the LEAST operational overhead?

Create an Application Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
Create a Network Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group. Correct Answer
Create a Gateway Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group.
Launch an EC2 instance with HAProxy configured that forwards requests to the three IP addresses.

Key Takeaways

It tests whether you can match an ELB type to a non-HTTP, arbitrary TCP protocol — the trap is assuming any load balancer can front any port.

This question tests load balancer selection for a custom TCP port (1028) spanning three Availability Zones with the least operational overhead. The answer establishes that a Network Load Balancer, with a TCP listener and target group on port 1028, is the correct choice.

Common mistake: Many candidates pick the Application Load Balancer (A) simply because it is the most familiar ELB, but ALB listeners only handle HTTP/HTTPS/gRPC traffic, not an arbitrary TCP application on port 1028.

Expert Analysis

Why the Answer Is Correct

The application listens on an arbitrary TCP port (1028), not HTTP or HTTPS, so the balancer must operate at Layer 4 where it can forward raw TCP flows without understanding the application protocol. A Network Load Balancer supports a TCP listener on port 1028, a TCP target group on port 1028, and registration of the three EC2 instances in three AZs; it also gives each AZ its own load balancer node, so instances stay reachable even if one AZ degrades. Because NLB is a fully managed service, listener, target group and health checks are all configuration rather than code you must operate, which satisfies the least-operational-overhead requirement. No HAProxy instance to patch, monitor, scale or make highly available is needed. As the community answer selection notes, this scenario is a straightforward "Network Load Balancer with a listener configured to use port 1028" case.

Why the Other Options Are Wrong

Option A fails because an Application Load Balancer only accepts HTTP, HTTPS or gRPC listener protocols; you cannot create a listener for a generic TCP service on port 1028, so the application would never be routable through it. Option C fails because a Gateway Load Balancer is designed for transparently distributing traffic to fleets of third-party virtual appliances (firewalls, IDS/IPS) using GENEVE encapsulation on port 6081, not for balancing user traffic to application servers. Option D fails on operational overhead: HAProxy running on a single EC2 instance introduces a self-managed, single-point-of-failure component that you must patch, scale and make highly available yourself, which is the opposite of "least operational overhead."

Community Comment Notes

The only visible comment, from Bad_Mat, selects option B and frames the item as a recent exam-style question, echoing the conclusion reached here through protocol reasoning rather than recall. The comment provides no competing rationale for A, C or D, so there is no dissent to reconcile. Treat the agreement as reassurance, not as the basis for the verdict — the decisive fact remains that port 1028 is raw TCP, which only a Layer 4 balancer can front.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a scenario names a specific non-HTTP port or protocol, immediately filter to Layer 4 (NLB) before reading the options in detail. Then eliminate any self-managed option (HAProxy, proxy EC2 fleet) whenever the question says "least operational overhead," since managed ELB features are almost always the intended answer.

Frequently Asked Questions

Why can't an Application Load Balancer handle the TCP port 1028 traffic?

ALB listeners only support HTTP, HTTPS and gRPC protocols, so a generic TCP service on port 1028 cannot be terminated or forwarded by an ALB.

Why is a Gateway Load Balancer wrong for balancing port 1028?

A GWLB distributes traffic to third-party virtual appliances using GENEVE on port 6081; it is not used to load balance application traffic to EC2 web/app servers.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

Bad_Mat 👍 1 Answered B

B. Create a Network Load Balancer with a listener configured to use port 1028. Create a target group on the listener for TCP port 1028. Register the EC2 instances with the target group. Question from 2024

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide