You deployed an app on a managed instance group that accepts TCP on port 389 and must preserve the client IP. Which load balancer should you use?

An external TCP Network Load Balancer is the correct choice because it is a pass-through load balancer that preserves the client's original IP address, which is a key requirement. It operates at Layer 4 (TCP) and is suitable for non-HTTP(S) traffic like TCP on port 389. A TCP Proxy Load Balancer terminates the TCP connection at the load balancer, losing the client IP. An SSL Proxy Load Balancer also terminates the connection and is designed for SSL/TLS traffic, not raw TCP. An internal TCP Network Load Balancer is for internal traffic within a VPC network, not for exposing an application to the internet.