The answer is a Network Load Balancer with TCP listeners and target groups in private subnets. This is the correct choice because an NLB operates at Layer 4, preserving the original client source IP address directly in the TCP flow—or optionally via Proxy Protocol—while supporting TLS pass-through by forwarding encrypted traffic untouched to the application, which also minimizes network latency by avoiding decryption overhead. On the SAA-C03 exam, this scenario tests your ability to distinguish between Layer 4 and Layer 7 load balancers, with a common trap being the temptation to use an Application Load Balancer, which would decrypt TLS and alter the source IP. Remember the memory tip: for pass-through and preserving the source IP, think “NLB: No Layer 7, Bye-bye decryption.”
SAA-C03 Design High-Performing Architectures Practice Question
This SAA-C03 practice question tests your understanding of design high-performing architectures. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Protocol and traffic notes:
- Transport: TCP over port 9000
- Payload: custom binary messages, not HTTP
- Requirement: preserve source IP address at the target
- Requirement: minimize latency and jitter
- Targets: EC2 instances in private subnets across 3 AZs
- Current proxy layer adds ~12 ms overhead and breaks client IP logging
Based on the exhibit, a trading platform exposes a custom binary TCP protocol to partner systems. The service must preserve the original client source IP for rate limiting, support TLS pass-through to the application, and minimize network latency. The team also wants a simple architecture that can scale across multiple Availability Zones. What load balancing option should the solutions architect choose?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
Protocol and traffic notes:
- Transport: TCP over port 9000
- Payload: custom binary messages, not HTTP
- Requirement: preserve source IP address at the target
- Requirement: minimize latency and jitter
- Targets: EC2 instances in private subnets across 3 AZs
- Current proxy layer adds ~12 ms overhead and breaks client IP logging
A
Application Load Balancer with path-based routing and HTTP/2 enabled.
Why wrong: ALB is for HTTP/HTTPS traffic and request-level routing, which does not fit a custom TCP binary protocol.
B
Network Load Balancer with TCP listeners and target groups in the private subnets.
NLB is designed for ultra-low-latency TCP/UDP workloads and preserves the client source IP to targets. It also supports multi-AZ scale-out and works well when the application is not HTTP-based.
C
Amazon API Gateway REST API integrated directly with the EC2 instances.
Why wrong: API Gateway is an HTTP-based API front door and is not suitable for a raw TCP binary protocol.
D
CloudFront in front of the EC2 instances to cache and terminate the client connections.
Why wrong: CloudFront is for HTTP(S) content delivery and caching, not for direct custom TCP proxying with source IP preservation at the target.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network Load Balancer with TCP listeners and target groups in the private subnets.
A Network Load Balancer (NLB) with TCP listeners is the correct choice because it preserves the original client source IP address (via the Proxy Protocol header or direct preservation in the TCP flow), supports TLS pass-through (no decryption at the load balancer), and minimizes latency by operating at Layer 4. It also scales across multiple Availability Zones with simple target groups in private subnets, meeting all stated requirements.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Application Load Balancer with path-based routing and HTTP/2 enabled.
Why it's wrong here
ALB is for HTTP/HTTPS traffic and request-level routing, which does not fit a custom TCP binary protocol.
✓
Network Load Balancer with TCP listeners and target groups in the private subnets.
Why this is correct
NLB is designed for ultra-low-latency TCP/UDP workloads and preserves the client source IP to targets. It also supports multi-AZ scale-out and works well when the application is not HTTP-based.
Clue confirmation
The clue word "minimum / minimize" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Amazon API Gateway REST API integrated directly with the EC2 instances.
Why it's wrong here
API Gateway is an HTTP-based API front door and is not suitable for a raw TCP binary protocol.
✗
CloudFront in front of the EC2 instances to cache and terminate the client connections.
Why it's wrong here
CloudFront is for HTTP(S) content delivery and caching, not for direct custom TCP proxying with source IP preservation at the target.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose ALB for its advanced routing features, forgetting that ALB cannot preserve client source IP for TCP traffic and terminates TLS, which violates the TLS pass-through requirement for a custom binary protocol.
Detailed technical explanation
How to think about this question
Network Load Balancers preserve client source IP by default when targets are in the same VPC, using the source IP of the original packet rather than the load balancer's IP. For TLS pass-through, the NLB simply forwards the encrypted TCP stream unchanged, allowing the application to handle decryption. In real-world scenarios, this is critical for financial trading platforms where latency must be sub-millisecond and partner systems require end-to-end encryption without intermediary decryption.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design High-Performing Architectures — This question tests Design High-Performing Architectures — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Network Load Balancer with TCP listeners and target groups in the private subnets. — A Network Load Balancer (NLB) with TCP listeners is the correct choice because it preserves the original client source IP address (via the Proxy Protocol header or direct preservation in the TCP flow), supports TLS pass-through (no decryption at the load balancer), and minimizes latency by operating at Layer 4. It also scales across multiple Availability Zones with simple target groups in private subnets, meeting all stated requirements.
What should I do if I get this SAA-C03 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "minimum / minimize". Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.