How to Balance TCP Port 1028 Across Three EC2 Instances?

Why the Answer Is Correct

The application listens on an arbitrary TCP port (1028), not HTTP or HTTPS, so the balancer must operate at Layer 4 where it can forward raw TCP flows without understanding the application protocol. A Network Load Balancer supports a TCP listener on port 1028, a TCP target group on port 1028, and registration of the three EC2 instances in three AZs; it also gives each AZ its own load balancer node, so instances stay reachable even if one AZ degrades. Because NLB is a fully managed service, listener, target group and health checks are all configuration rather than code you must operate, which satisfies the least-operational-overhead requirement. No HAProxy instance to patch, monitor, scale or make highly available is needed. As the community answer selection notes, this scenario is a straightforward "Network Load Balancer with a listener configured to use port 1028" case.

Why the Other Options Are Wrong

Option A fails because an Application Load Balancer only accepts HTTP, HTTPS or gRPC listener protocols; you cannot create a listener for a generic TCP service on port 1028, so the application would never be routable through it. Option C fails because a Gateway Load Balancer is designed for transparently distributing traffic to fleets of third-party virtual appliances (firewalls, IDS/IPS) using GENEVE encapsulation on port 6081, not for balancing user traffic to application servers. Option D fails on operational overhead: HAProxy running on a single EC2 instance introduces a self-managed, single-point-of-failure component that you must patch, scale and make highly available yourself, which is the opposite of "least operational overhead."

Community Comment Notes

The only visible comment, from Bad_Mat, selects option B and frames the item as a recent exam-style question, echoing the conclusion reached here through protocol reasoning rather than recall. The comment provides no competing rationale for A, C or D, so there is no dissent to reconcile. Treat the agreement as reassurance, not as the basis for the verdict — the decisive fact remains that port 1028 is raw TCP, which only a Layer 4 balancer can front.