Free SAA-C03 practice scenarios: ALB vs NLB

Layer 7 or layer 4 — the choice the exam keeps posing, and the requirement words that settle it. Six scenarios, SAA-C03, 2026 edition.

Try 6 free load-balancer scenarios in the exam's own style — every answer explained, no sign-up.

Straight to the 6 free questions ↓

Choosing a load balancer is one of the SAA-C03’s cleanest decisions once you anchor on the layer. The Application Load Balancer lives at layer 7 and understands HTTP; the Network Load Balancer lives at layer 4 and moves TCP and UDP fast. Almost every question is a requirement sentence pointing at one or the other.

Layer 7 = content routing (ALB)

Reach for the Application Load Balancer whenever the decision depends on the content of an HTTP request:

Path-based routing — /api to one target group, /images to another.
Host-based routing — app1.example.com and app2.example.com on one load balancer, each to its own target group.
HTTP-aware features generally — HTTPS termination, header rules, redirects, WebSockets.

If the stem mentions a URL path, a hostname, or any HTTP content, it is describing the ALB. A Network Load Balancer cannot see any of it — it never reads above layer 4.

Layer 4 = performance, IPs, source preservation (NLB)

Reach for the Network Load Balancer when the requirement is about the transport layer rather than content:

Non-HTTP protocols — raw TCP or UDP, like a game backend or a custom protocol.
Extreme performance — millions of requests per second at ultra-low latency.
Static / Elastic IP addresses — for a partner’s firewall allowlist, where fixed addresses matter. The ALB’s addresses are AWS-managed and change; this is a defining difference.
Client source-IP preservation — the backend sees the real client IP directly, without parsing X-Forwarded-For.

Any of those four phrases is a tell for the NLB.

The third option: Gateway Load Balancer

When the scenario is about inserting third-party virtual appliances — firewalls, deep packet inspection — transparently into the traffic path, it is the Gateway Load Balancer. It is not client-facing like the other two; it exists to deploy and scale inline security appliances. The exam offers it as a distractor on ALB/NLB questions and as the answer on appliance-insertion ones.

How to use the six scenarios below

Answer each one before opening the explanation, and when you miss, find the requirement word that settled it — “path”, “host header”, “UDP”, “static IP”, “source IP”, “inline appliance”. Every explanation names that word and then shows why the other load balancers cannot satisfy it. The discrimination is almost mechanical once you read for the layer, and the reasoning below builds that reflex. For the domain overview, see Design Resilient Architectures.

A comparison of Elastic Load Balancing options. The Application Load Balancer operates at layer 7 for HTTP and HTTPS, routing by path, host header and other content to different target groups. The Network Load Balancer operates at layer 4 for TCP and UDP, offers static and Elastic IP addresses, preserves the client source IP, and handles millions of requests per second at ultra-low latency. The Gateway Load Balancer inserts third-party virtual appliances such as firewalls inline into the traffic path.

6 free SAA-C03 practice questions

Answers and explanations — no email wall

SAA-C03 Question 1 of 6

A single application is split into microservices. Requests to /api should go to one target group and requests to /images to another, based on the URL path. Which load balancer meets this most directly?

Answer: A — An Application Load Balancer using path-based routing rules.

Routing by URL path is a layer-7, content-aware decision, and the Application Load Balancer is built for exactly that — path-based rules send /api and /images to different target groups. Why not the others: a Network Load Balancer works at layer 4 on TCP/UDP and cannot see a URL path, so it cannot route on it. A Gateway Load Balancer is for inserting inline appliances, not content routing. The Classic Load Balancer is legacy and lacks modern path-based rules. Content-based routing is the ALB's signature.

SAA-C03 Question 2 of 6

A multiplayer game backend uses a custom UDP protocol and must be load balanced with the lowest possible latency at very high throughput. Which load balancer is appropriate?

Answer: A — A Network Load Balancer.

The Network Load Balancer operates at layer 4 and supports TCP and UDP at ultra-low latency and very high throughput — the right fit for a custom UDP game protocol. Why not the others: the Application Load Balancer only handles HTTP/HTTPS, so it cannot balance a raw UDP protocol at all. A Gateway Load Balancer is for chaining security appliances, not for serving game traffic. CloudFront is a content delivery network for cacheable web content, not a UDP load balancer. Non-HTTP protocols at high performance mean the NLB.

SAA-C03 Question 3 of 6

A load balancer's addresses must be added to a partner's firewall allowlist, so they must be fixed and known in advance. The traffic is TCP. Which option provides stable IP addresses?

Answer: A — A Network Load Balancer, which supports static IPs and Elastic IP assignment.

A Network Load Balancer can present static IP addresses and lets you assign an Elastic IP per Availability Zone — stable addresses a partner can safely allowlist. Why not the others: an Application Load Balancer's IP addresses are managed by AWS and change over time, so allowlisting them is unreliable — this is a defining ALB limitation. A Classic Load Balancer offers a hostname but not assignable static IPs. A Gateway Load Balancer does not serve this client-facing role. Fixed IPs for allowlisting point to the NLB.

SAA-C03 Question 4 of 6

A backend service must see the original client's source IP address for per-client rate limiting, without parsing an X-Forwarded-For header. Which load balancer preserves the client source IP to the targets by default?

Answer: A — A Network Load Balancer, which preserves the client source IP.

A Network Load Balancer operates at layer 4 and preserves the client's source IP to the target, so the backend sees the real client address directly. Why not the others: an Application Load Balancer terminates the connection and forwards the client IP only in the X-Forwarded-For header — which the requirement explicitly rules out parsing. The source IP is not 'always preserved' across all load balancers, so the last option is wrong, and that is exactly the distinction the question tests. Native source-IP preservation is an NLB property.

SAA-C03 Question 5 of 6

One load balancer must serve two applications on different domain names — app1.example.com and app2.example.com — sending each to its own target group. Which feature meets this?

Answer: A — Application Load Balancer host-based routing rules.

Host-based routing reads the HTTP Host header and sends each domain to its own target group, and it is an Application Load Balancer capability — one ALB fronting two apps. Why not the others: a Network Load Balancer works at layer 4 and cannot read the Host header, so it cannot route by hostname. Deploying a separate NLB per domain is more infrastructure than the single-load-balancer requirement asks for. A Gateway Load Balancer does not do content routing. Routing by hostname is layer-7 ALB territory.

SAA-C03 Question 6 of 6

A security team must pass all inbound VPC traffic through a fleet of third-party firewall virtual appliances for inspection, inserted transparently into the network path. Which service is designed for this?

Answer: A — A Gateway Load Balancer.

A Gateway Load Balancer is purpose-built to deploy and scale third-party virtual appliances — firewalls, intrusion inspection — inserting them transparently into the traffic path. Why not the others: the Application and Network Load Balancers distribute client traffic to application targets; neither is a mechanism for chaining inspection appliances inline. Route 53 is DNS and does not touch packet inspection. Inline appliance insertion is the Gateway Load Balancer's whole reason to exist.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 780 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

780 questions in 12 full tests, SAA-C03 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

How do I choose between ALB and NLB on the exam?

Read the layer. If the requirement is about HTTP content — paths, host headers, routing rules — it is layer 7 and the Application Load Balancer. If it is about raw TCP/UDP performance, static IPs, or preserving the client source IP, it is layer 4 and the Network Load Balancer. One or two requirement words almost always settle it.

When is it a Gateway Load Balancer instead?

When the scenario is about inserting third-party virtual appliances — firewalls, deep packet inspection — inline into the traffic path. It is not a client-facing application load balancer; it exists to chain security appliances transparently.

Are these real exam questions?

No. They are original scenarios written for this page in the exam's style and difficulty. Reproducing real exam items violates the AWS certification agreement and can cost a candidate their certification — ours come with the reasoning attached instead.

What is the one-line takeaway?

ALB for layer-7 HTTP content routing; NLB for layer-4 TCP/UDP, static IPs and source-IP preservation; Gateway Load Balancer for inline third-party appliances.

Updated for SAA-C03 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.