Practice — Load Balancing (5 questions)

Your application handles two types of requests:

• Fast API calls that complete in ~5 ms
• Video transcoding jobs that take ~30 seconds

Both types hit the same pool of servers. Would round-robin or least-connections be more appropriate? Explain why.

You are designing an API gateway for a SaaS product. You need to:

1. Route /api/v1/* to a fleet of API servers.
2. Route /static/* to an S3 bucket origin.
3. Block requests containing a known malicious User-Agent header.

Can you accomplish all three with a Layer 4 load balancer? Why or why not? What would you use instead?

Design a /health endpoint for a FastAPI service that:

• Returns 200 OK when the service is ready to handle traffic.
• Returns a non-200 status when it is not ready (e.g., during startup, database is unreachable, or graceful shutdown is in progress).

What should the health check verify? What should it NOT check?

A teammate proposes enabling sticky sessions on the load balancer to solve a bug where users intermittently lose their shopping cart contents. What is the root cause of the bug, and is sticky sessions a good fix? What would you recommend instead?

Your load balancer is configured to terminate TLS — it accepts HTTPS from clients and forwards plain HTTP to backend servers on the internal network.

A security-conscious teammate raises a concern: "Internal traffic is now unencrypted — this is insecure." How do you respond? Under what conditions would you consider end-to-end TLS (re-encrypting to backends)?