ALB vs. NLB: Nailing Load Balancer Questions on the AWS Certified Solutions Architect Exam (SAA-C03)

The AWS Solutions Architect Associate (SAA-C03) is not an exam that evaluates what you know.

It's a test of your ability to build solutions on AWS. So the exam presents many questions that have more than one technical solution and you have to isolate the best among them.

When it comes to distributing traffic, the exam consistently pits the Application Load Balancer (ALB) against the Network Load Balancer (NLB). On the surface, they both route incoming traffic to backend targets. But in an exam scenario, picking the wrong one based on a single hidden constraint will sink your architecture.

Think of the Application Load Balancer (ALB) as your highly intelligent, Layer 7 traffic cop. It reads the actual HTTP/HTTPS payload, understands URL paths and headers, and makes smart, content-aware routing decisions. It is the undisputed go-to for modern web applications, microservices, and containerized workflows.

The Network Load Balancer (NLB), on the other hand, is your Layer 4 speed demon. It doesn't care about what is inside the application payload; it only looks at IPs and ports. Built for raw performance, it handles millions of requests per second and absorbs sudden, extreme traffic spikes instantly—all while providing the rock-solid stability of a static IP address.

Let's break down exactly where these two diverge and how the exam uses those differences to set traps.

Key Differences: The SAA-C03 Decision Matrix

To pass the SAA-C03, you don't need to memorize every feature flag; you need to understand the hard architectural boundaries that make one service impossible to use over the other.

Here is how the ALB and NLB stack up side-by-side:

Feature	Application Load Balancer (ALB)	Network Load Balancer (NLB)
OSI Layer	Layer 7 (Application)	Layer 4 (Transport)
Supported Protocols	HTTP, HTTPS, gRPC, WebSockets	TCP, UDP, TLS
IP Address Management	Dynamic (IP addresses change as AWS scales the ALB automatically)	Static (1 static IP per Availability Zone; supports Elastic IPs)
Routing Mechanism	URL paths (/api), hostnames (app.com), HTTP headers, query strings	IP addresses and port numbers only
Performance & Scaling	Scales automatically, but requires "pre-warming" by AWS for sudden, extreme surges	Handles millions of requests per second with ultra-low latency; handles sudden spikes natively
Target Types	EC2 Instances, IP addresses, Lambda functions, nested ALBs	EC2 Instances, IP addresses, ALBs
Security & Authentication	Native AWS WAF integration, SSL termination, OIDC, Amazon Cognito	No direct AWS WAF integration; relies on target-level or network security
Client Source IP	Modifies the packet header; passes the original client IP in the X-Forwarded-For header	Preserves the original client source IP directly in the TCP packet

The 3 Core Architectural Constraints to Memorize

When reading exam scenarios, look out for these three technical deal-breakers:

1. Static IP Requirements vs. Dynamic Scaling

• ALB constraint: An ALB gives you a DNS name, not a fixed set of IP addresses. If your architecture must interface with legacy on-premises firewalls that require hardcoded, whitelisted IP addresses, a standalone ALB fails immediately.
• NLB solution: An NLB assigns a deterministic, static Elastic IP to each Availability Zone it spans, giving you a fixed front-door address.

2. Protocol Capabilities (Layer 7 vs. Non-HTTP Traffic)

• ALB constraint: ALB strictly handles web protocols. If your application relies on raw TCP stream processing, UDP (such as DNS, gaming, or streaming), or custom binary protocols, an ALB cannot inspect or route that traffic.
• NLB solution: NLB operates at the transport layer, making it protocol-agnostic for any TCP/UDP workload.

3. Traffic Spikes and Latency Sensitivities

• ALB constraint: While an ALB scales to immense loads, sudden traffic spikes (e.g., doubling traffic in under a minute during a flash sale) require time for AWS to scale out the underlying ALB nodes.
• NLB solution: NLB is architected to absorb instant, unpredictable bursts of millions of requests per second with sub-millisecond latencies without requiring pre-warming.

How the SAA-C03 Sets the Trap

The exam rarely asks you to simply define an ALB or an NLB. Instead, it presents a business requirement with one critical constraint hidden in the text. Here are the classic traps to watch for:

1. The Static IP Trap

• The Scenario: A legacy on-premises data center needs to connect to your AWS environment, and the on-premises firewalls require hardcoded, whitelisted IP addresses.
• The Trap: You might see HTTP/HTTPS traffic mentioned and immediately jump to ALB as the answer.
• The Solution: An ALB's IPs change dynamically. You must use an NLB to get static Elastic IPs, or use a hybrid approach (placing an NLB in front of an ALB).

2. The "Sudden Spike" Trap

• The Scenario: A company is launching a highly anticipated product, or running a major ad campaign, and expects a massive, instantaneous surge of millions of users in seconds.
• The Trap: Defaulting to ALB just because it is a web application.
• The Solution: ALBs require time (or manual pre-warming by AWS Support) to scale out for sudden, massive spikes. An NLB natively absorbs extreme, sudden volatility without dropping connections.

3. The Microservices Trap

• The Scenario: Traffic hitting [example.com/api](https://example.com/api) needs to route to one Auto Scaling Group, while [example.com/images](https://example.com/images) needs to route to an S3 bucket or another ASG.
• The Trap: The question might mention high performance, tempting you toward the NLB.
• The Solution: NLBs operate at Layer 4 and cannot read the URL path. You absolutely need the Layer 7 intelligence of an ALB for path-based or host-based routing.

Test Your Knowledge: Keyword Spotting

Let’s look at two sample questions to see how this plays out in practice.

Sample Question 1:
A company is migrating a legacy web application to AWS consisting of a fleet of EC2 instances. The company's security team mandates that the application must be protected against common web exploits like SQL injection. Furthermore, the application routes traffic to different backend services depending on the URL path. Which load balancing solution should the Solutions Architect choose?

• Keywords to spot: "protected against common web exploits" (requires AWS WAF integration), "depending on the URL path" (requires Layer 7 path-based routing).
• The Answer: Application Load Balancer (ALB). An NLB cannot natively route by URL path or integrate directly with AWS WAF.

Sample Question 2:
A gaming company is launching a new real-time multiplayer game that uses UDP for communication. The launch is highly anticipated, and the engineering team expects millions of concurrent connections within the first few minutes of launch. The backend servers require the load balancer to have a static IP address to integrate with a third-party analytics provider. Which load balancer meets these requirements?

• Keywords to spot: "uses UDP" (Layer 4 traffic), "millions of concurrent connections within the first few minutes" (sudden spike without pre-warming), "static IP address" (fixed endpoint requirement).
• The Answer: Network Load Balancer (NLB). An ALB does not support UDP, cannot provide a static IP, and requires pre-warming for sudden, massive scaling.

Keep learning and practicing

Mastering the nuances between services like the Application Load Balancer and the Network Load Balancer is the secret to passing the SAA-C03. The exam doesn't just want to know if you can build an architecture. As is the case in the real world, the exam wants to know if you can build the right architecture when boxed in by strict security boundaries, legacy network constraints, or extreme scaling demands.

When you encounter a load balancer question, always look for the hidden constraint. Is there a demand for a static IP? Are they expecting UDP traffic? Is there an instantaneous, massive spike in users without time to pre-warm? Spotting these exact keywords will immediately eliminate the wrong answers and guide you to the correct solution.

Don't let similar-sounding services cost you easy points on exam day. If you found this architectural breakdown helpful, subscribe to the daily exam question at CloudQubes.

You'll get a mock exam question delivered straight to your inbox every single day to build a learning streak based on the science of microlearning.