SAA-C03 Design Secure Architectures Practice Question
A legacy market-data service runs on EC2 and exposes a custom TCP protocol. Clients must connect over TCP with very low latency, and the team wants static IP addresses at the load-balancing layer. Which AWS service is the best fit?
⚠ Common exam trap
Many candidates confuse the ALB's 'advanced routing' capabilities with support for all protocols, but ALB is strictly Layer 7 and cannot handle raw TCP or custom protocols, making NLB the only correct choice for TCP with static IPs and low latency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Load Balancer, because it supports TCP, static IPs, and very low latency.
The Network Load Balancer (NLB) operates at Layer 4, supports TCP traffic natively, provides static IP addresses per Availability Zone, and delivers very low latency by processing packets without inspecting application-layer headers. This makes it the ideal choice for a legacy market-data service that requires a custom TCP protocol and fixed IPs at the load-balancing layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Application Load Balancer, because it provides advanced routing for all protocols.
Why it's wrong here
An Application Load Balancer is designed for HTTP and HTTPS traffic, not arbitrary TCP protocols. It can do content-based routing for web workloads, but it does not meet the requirement for a custom TCP service with static IPs and minimal latency. Using ALB would mismatch the protocol and the performance profile of the application.
When this WOULD be correct
An Application Load Balancer would be correct for a web application requiring advanced HTTP/HTTPS routing (e.g., path-based or host-based routing) with SSL termination, where static IPs are not needed and clients use HTTP/HTTPS.
- ✓
Network Load Balancer, because it supports TCP, static IPs, and very low latency.
Why this is correct
A Network Load Balancer is the best fit for a custom TCP service that needs extremely low latency and static IP addresses. NLB operates at Layer 4, preserves high throughput, and is commonly used when protocol simplicity and performance matter more than application-layer routing features. It matches the workload's network requirements without adding unnecessary HTTP-specific behavior.
- ✗
Amazon API Gateway, because it can front any network protocol with throttling.
Why it's wrong here
API Gateway is focused on API management for HTTP-based request/response patterns, not arbitrary TCP protocols. It provides useful controls such as throttling and authorization, but it is not a drop-in solution for a low-latency custom TCP service. The protocol mismatch makes it the wrong tool for this use case.
When this WOULD be correct
A question asking for a fully managed service to expose RESTful APIs or WebSocket endpoints with throttling, caching, and authentication, where the backend is an AWS service like Lambda or HTTP endpoints.
- ✗
Amazon CloudFront, because it can route traffic to EC2 instances at the edge.
Why it's wrong here
CloudFront is an edge content delivery network optimized for caching and accelerating HTTP and HTTPS content. It is not a general TCP load balancer and cannot directly satisfy a custom TCP protocol requirement. While it can improve web delivery, it does not provide the static IP and Layer 4 behavior this service needs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Network Load Balancer, because it supports TCP, static IPs, and very low latency.Correct answer▾
Why this is correct
A Network Load Balancer is the best fit for a custom TCP service that needs extremely low latency and static IP addresses. NLB operates at Layer 4, preserves high throughput, and is commonly used when protocol simplicity and performance matter more than application-layer routing features. It matches the workload's network requirements without adding unnecessary HTTP-specific behavior.
✗Application Load Balancer, because it provides advanced routing for all protocols.Wrong answer — click to see why▾
Why this is wrong here
Application Load Balancer does not support TCP at the transport layer; it operates at Layer 7 (HTTP/HTTPS) and cannot handle custom TCP protocols. It also does not provide static IP addresses.
★ When this WOULD be the correct answer
An Application Load Balancer would be correct for a web application requiring advanced HTTP/HTTPS routing (e.g., path-based or host-based routing) with SSL termination, where static IPs are not needed and clients use HTTP/HTTPS.
Why candidates choose this
Candidates may assume ALB supports all protocols because it is a common load balancer, or they confuse its Layer 7 capabilities with Layer 4, overlooking the requirement for custom TCP and static IPs.
✗Amazon API Gateway, because it can front any network protocol with throttling.Wrong answer — click to see why▾
Why this is wrong here
Amazon API Gateway does not support custom TCP protocols; it only handles HTTP/HTTPS and WebSocket traffic, and it does not provide static IP addresses at the load-balancing layer.
★ When this WOULD be the correct answer
A question asking for a fully managed service to expose RESTful APIs or WebSocket endpoints with throttling, caching, and authentication, where the backend is an AWS service like Lambda or HTTP endpoints.
Why candidates choose this
Candidates may think API Gateway can handle any protocol because it supports WebSocket, or they confuse its throttling and routing features with load balancing capabilities.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.