Layer 4 vs Layer 7 load balancers

WHAT THIS TESTS The interviewer wants to see that you understand the OSI model and how a load balancer's operating layer changes what routing decisions it can make and at what cost.

A GOOD ANSWER COVERS A Layer 4 load balancer operates at the transport layer. It forwards packets based only on source and destination IP addresses and TCP or UDP ports. It does not read the payload, so it works with any protocol, adds minimal latency, and handles very high throughput. A Layer 7 load balancer operates at the application layer. It terminates the connection, reads the HTTP request, and can route based on hostname, URL path, headers, cookies, or query strings. This enables content-based routing, TLS termination, sticky sessions, and request rewriting, at the cost of more CPU and slightly higher latency. A strong use case for L7 is routing /api to one service and /static to another, or canary releases by header. A strong use case for L4 is balancing a database protocol, a gRPC stream over raw TCP, or any workload where throughput matters more than inspection.

COMMON WRONG ANSWERS Claiming Layer 7 is always the better choice ignores its overhead and its inability to handle non-HTTP traffic cleanly. Saying L4 cannot do TLS is wrong; it passes encrypted bytes through untouched. Confusing the layers with hardware versus software is also a mistake.

LIKELY FOLLOW-UPS How does TLS termination differ from TLS passthrough? How does an L7 balancer preserve the client IP? What happens to long-lived connections during a deploy?

ONE CONCRETE EXAMPLE An AWS Application Load Balancer is L7 and routes /checkout to a payments service by path. A Network Load Balancer is L4 and fronts a high-volume MQTT broker, preserving source IP and sustaining millions of connections with predictable latency.