SAA-C03 Design High-Performing Architectures Practice Question
A startup runs an HTTP/2 API that also supports WebSocket connections. They need path-based routing to separate microservices (for example, /api/* to Service A and /metrics/* to Service B) and want TLS terminated at the load balancer. Which AWS option best meets these requirements while maintaining high request performance?
⚠ Common exam trap
Many exam-takers confuse NLB's Layer 4 capabilities with ALB's Layer 7 features, incorrectly assuming NLB can handle path-based routing or WebSocket upgrades, when in fact it cannot inspect application-layer data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an Amazon ALB with HTTP/2 support, WebSocket upgrades enabled, and listener rules for host/path-based routing.
An Application Load Balancer (ALB) natively supports HTTP/2, WebSocket upgrades, and path-based routing via listener rules. It terminates TLS at the load balancer, offloading encryption from backend services, and maintains high performance for both HTTP/2 and WebSocket traffic. This makes ALB the correct choice for the startup's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an Amazon NLB and configure target groups with HTTP health checks and listener rules for path-based routing.
Why it's wrong here
An NLB operates at Layer 4 (TCP/UDP). It can forward connections and perform basic health checks, but it does not inspect HTTP request paths to make Layer 7 routing decisions like /api/* vs /metrics/*. Path-based routing requires a Layer 7 load balancer such as the ALB.
When this WOULD be correct
When the requirement is for ultra-high performance with static IP addresses, and routing is based on TCP/UDP traffic (e.g., port-based) without need for HTTP features like path-based routing or WebSocket support.
- ✓
Use an Amazon ALB with HTTP/2 support, WebSocket upgrades enabled, and listener rules for host/path-based routing.
Why this is correct
An ALB supports Layer 7 features needed here: it can terminate TLS on an HTTPS listener, evaluate HTTP host/path routing rules, and it supports WebSocket by allowing HTTP Upgrade behavior through the ALB to the targets. ALBs also support HTTP/2 on HTTPS listeners, which helps maintain high request performance.
- ✗
Use Amazon API Gateway with a single backend integration and rely on the client to route requests to different microservices.
Why it's wrong here
API Gateway can route requests, but the scenario specifically asks for the best load-balancing choice to perform TLS termination and path-based routing between microservices. Offloading routing responsibility to clients adds complexity and does not satisfy the intent of centralizing path-based routing and connection handling at the load balancer layer.
When this WOULD be correct
When the requirement is to expose a RESTful API with features like throttling, caching, and authentication, and the backend is a single service or can be handled via a single integration, with no need for WebSocket support or path-based routing to multiple microservices.
- ✗
Use Amazon CloudFront without an ALB, and route requests to microservices using only custom origin headers.
Why it's wrong here
Custom origin headers alone do not implement path-based routing between microservices. To route based on paths and forward WebSocket traffic correctly, CloudFront would require additional behaviors (and often more configuration) to map request paths to distinct origins. In contrast, an ALB provides the required Layer 7 path routing and TLS termination directly for the application services behind it.
When this WOULD be correct
A question requiring global content delivery with low latency, DDoS protection, and caching for static or dynamic content, where the backend is a single origin (e.g., an ALB or S3) and WebSocket support is not needed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use an Amazon ALB with HTTP/2 support, WebSocket upgrades enabled, and listener rules for host/path-based routing.Correct answer▾
Why this is correct
An ALB supports Layer 7 features needed here: it can terminate TLS on an HTTPS listener, evaluate HTTP host/path routing rules, and it supports WebSocket by allowing HTTP Upgrade behavior through the ALB to the targets. ALBs also support HTTP/2 on HTTPS listeners, which helps maintain high request performance.
✗Use an Amazon NLB and configure target groups with HTTP health checks and listener rules for path-based routing.Wrong answer — click to see why▾
Why this is wrong here
NLB does not support path-based routing or HTTP/2; it operates at Layer 4 and cannot inspect HTTP paths or handle WebSocket upgrades natively.
★ When this WOULD be the correct answer
When the requirement is for ultra-high performance with static IP addresses, and routing is based on TCP/UDP traffic (e.g., port-based) without need for HTTP features like path-based routing or WebSocket support.
Why candidates choose this
Candidates may think NLB can handle HTTP/2 and path routing because it supports HTTP health checks, but NLB lacks Layer 7 capabilities needed for path-based routing and WebSocket upgrades.
✗Use Amazon API Gateway with a single backend integration and rely on the client to route requests to different microservices.Wrong answer — click to see why▾
Why this is wrong here
API Gateway does not natively support WebSocket connections with path-based routing to separate microservices; it would require custom integration logic and cannot directly route to different services based on path patterns like /api/* and /metrics/*.
★ When this WOULD be the correct answer
When the requirement is to expose a RESTful API with features like throttling, caching, and authentication, and the backend is a single service or can be handled via a single integration, with no need for WebSocket support or path-based routing to multiple microservices.
Why candidates choose this
Candidates may think API Gateway is a natural choice for API management and assume it can handle WebSocket and path-based routing, but they overlook its limitations with WebSocket and direct microservice routing without custom workarounds.
✗Use Amazon CloudFront without an ALB, and route requests to microservices using only custom origin headers.Wrong answer — click to see why▾
Why this is wrong here
CloudFront does not natively support WebSocket connections or path-based routing to separate microservices based on URL paths like /api/* and /metrics/*; it is a CDN, not a load balancer with those routing capabilities.
★ When this WOULD be the correct answer
A question requiring global content delivery with low latency, DDoS protection, and caching for static or dynamic content, where the backend is a single origin (e.g., an ALB or S3) and WebSocket support is not needed.
Why candidates choose this
Candidates may think CloudFront can handle path-based routing via behaviors and assume it supports WebSocket, but WebSocket support in CloudFront is limited and not designed for microservice path-based routing with TLS termination at the edge.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.