SAA-C03 Design High-Performing Architectures Practice Question
Your company currently uses an Application Load Balancer (ALB) in front of a service that receives a large number of TCP and UDP packets (including UDP-based telemetry). During load tests, you need to support both TCP and UDP traffic at high throughput while keeping stable IP endpoints for a downstream firewall allowlist. Which change best meets these requirements?
⚠ Common exam trap
Many exam-takers assume an ALB can handle all traffic types because it is the most commonly used load balancer, but they forget that ALB is strictly Layer 7 and cannot process UDP packets, making the NLB the only correct choice for mixed TCP/UDP workloads requiring static IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Switch to a Network Load Balancer (NLB) configured for TCP/UDP, and use Elastic IPs to provide stable endpoint IP addresses for allowlisting.
A Network Load Balancer (NLB) operates at Layer 4 and can handle both TCP and UDP traffic natively, unlike an ALB which only supports HTTP/HTTPS and cannot forward UDP packets. By assigning Elastic IPs to the NLB, you provide stable, static IP endpoints that can be added to a downstream firewall allowlist, meeting both the protocol and throughput requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Switch to a Network Load Balancer (NLB) configured for TCP/UDP, and use Elastic IPs to provide stable endpoint IP addresses for allowlisting.
Why this is correct
NLB operates at Layer 4 and supports both TCP and UDP. For stable IP allowlists, you can associate Elastic IP addresses with the NLB so the load balancer exposes consistent IPs (as opposed to relying on dynamic addresses). This combination directly satisfies protocol support and stable endpoint requirements.
- ✗
Keep the ALB and add an AWS WAF Web ACL to improve throughput and add static IP support.
Why it's wrong here
WAF can add security filtering and some rate/managed protections, but it does not enable UDP packet handling at the load balancer layer. Also, WAF does not provide the kind of stable, load-balancer-level IP endpoint behavior required for firewall allowlisting of UDP telemetry.
- ✗
Replace the ALB with an API Gateway REST API to support UDP because API Gateway can forward UDP packets.
Why it's wrong here
API Gateway is designed for HTTP/HTTPS APIs. It does not forward raw UDP packets for telemetry use cases in the way a Layer 4 load balancer does, so this does not satisfy UDP support requirements.
- ✗
Use an Auto Scaling group with multiple EC2 instances and no load balancer to avoid any networking bottlenecks.
Why it's wrong here
Removing the load balancer eliminates managed Layer 4 traffic distribution and does not inherently provide stable IP endpoints for allowlisting. Without a load balancer, you must solve both traffic distribution and endpoint stability yourself, and you generally do not improve throughput for packet-based protocols by removing the balancer.
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.