Securing NLB with Security Groups for Minimal Change

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Recreate the NLB with a security group to allow only trusted IP addresses.

Question

A company hosts a video streaming web application in a VPC. The company uses a Network Load Balancer (NLB) to handle TCP traffic for real-time data processing. There have been unauthorized attempts to access the application. The company wants to improve application security with minimal architectural change to prevent unauthorized attempts to access the application. Which solution will meet these requirements?
  1. Implement a series of AWS WAF rules directly on the NLB to filter out unauthorized traffic.
  2. Recreate the NLB with a security group to allow only trusted IP addresses. Correct Answer
  3. Deploy a second NLB in parallel with the existing NLB configured with a strict IP address allow list.
  4. Use AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized access attempts.

Key Takeaways

The exam tests knowledge of recent NLB enhancements. The common trap is assuming NLBs cannot use security groups or confusing them with WAF/Shield capabilities.

This question tests the capability of Network Load Balancers (NLBs) to utilize security groups for access control. The correct solution leverages this feature to restrict traffic without altering the core architecture.

Common mistake: Many learners choose D (AWS Shield Advanced) because they associate 'unauthorized attempts' with DDoS attacks, overlooking that the scenario specifies IP-based unauthorized access, not volumetric flooding.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because AWS now supports Security Groups on Network Load Balancers. By recreating or modifying the NLB to attach a Security Group, you can filter inbound traffic based on source IP addresses. This directly addresses the requirement to prevent unauthorized IP access while maintaining the existing NLB architecture (minimal change). As one commenter noted, "Network Load Balancers (NLBs) now supports security groups, enabling you to filter the traffic that your NLB accepts and forwards to the application."

Why the Other Options Are Wrong

Option A is incorrect because AWS WAF operates at Layer 7 (Application Layer) and only integrates with Application Load Balancers (ALB), API Gateway, and CloudFront, not NLBs which operate at Layer 4. Option C suggests deploying a second NLB, which introduces unnecessary complexity and violates the 'minimal architectural change' requirement. Option D, AWS Shield Advanced, protects against DDoS attacks but does not provide granular IP-based access control for specific unauthorized users in the manner described.

Community Comment Notes

There is significant debate in the community between options B and D. Some users argue for D, stating it prevents unauthorized access via DDoS protection. However, the consensus among experts clarifies that Shield is for volumetric attacks, whereas the prompt implies specific unauthorized IP attempts. One user correctly pointed out: "A - AWS WAF works at Layer 7... so WAF works only with Application Load Balancers." Another emphasized that "shield is only for DDos attacks protection," reinforcing why B is the precise fit for IP filtering.

Official Reference

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/target-group-register-targets.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check if the load balancer type matches the security service. Remember: WAF is for ALB/API Gateway/CloudFront; Security Groups are now supported by NLBs. If the goal is IP filtering on an NLB, Security Groups are the modern, minimal-change solution.

Frequently Asked Questions

Can AWS WAF be attached directly to an NLB?

No, AWS WAF only works with Application Load Balancers (ALB), API Gateway, and CloudFront distributions, as it operates at Layer 7.

Why is AWS Shield Advanced not the best choice here?

Shield Advanced protects against DDoS attacks (volumetric/protocol), not specific unauthorized IP access attempts. It doesn't filter legitimate traffic from bad IPs selectively like a Security Group.

More SAA-C03 FAQ →

Community Votes

B
50%
D
50%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. dragossky 👍 4 Answered D
    Use AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized access attempts.
  2. example_ 👍 4 Answered B
    https://aws.amazon.com/about-aws/whats-new/2023/08/network-load-balancer-supports-security-groups/
  3. LeonSauveterre 👍 3 Answered D
    A - AWS WAF works at Layer 7 (application layer) and is designed for HTTP/HTTPS traffic, so WAF works only with Application Load Balancers (ALB), API Gateway, and CloudFront. C - Works but comes with unnecessary complexity and introduces architectural changes. So A & C are out. I'm actually torn between B and D. If the primary issue is unauthorized IP access and not large-scale DDoS attacks, then B might be the answer, but NLBs do not directly associate with security groups. Security groups are applied to the targets of the NLB (EC2 instances, IP addrs, or ALBs). Also, this is an architectural change. On the other hand, if the primary concern includes DDoS attacks, option D (AWS Shield Advanced) becomes more relevant but this is so much more expensive and may still be overkill for simple IP-based access control. I'm gonna go with D if it shows up in my exam.
  4. Anyio 👍 3 Answered D
    The correct answer is D. Use AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized access attempts. Explanation: Option D: Correct. AWS Shield Advanced is designed to protect against DDoS attacks, which can be a source of unauthorized access attempts. It provides enhanced protection features for applications behind a Network Load Balancer, offering additional security measures without requiring significant architectural changes. By leveraging AWS Shield Advanced, the company can gain comprehensive DDoS protection tailored for use with their existing NLB setup. Option B: Incorrect. NLBs do not support security groups which are applicable to instances, not to the NLB itself. In addition, recreating the NLB to deal with unauthorized access attempts does not align with the requirement for minimal architectural change.
  5. Jeyaluxshan 👍 3
    Network Load Balancers (NLB) now supports security groups, enabling you to filter the traffic that your NLB accepts and forwards to your application. Using security groups, you can configure rules to help ensure that your NLB only accepts traffic from trusted IP addresses, and centrally enforce access control policies. This improves your application's security posture and simplifies operations
Show 10 more comments
  1. Sergantus 👍 3 Answered D
    The answer should be D. It makes no sense to pick B for a public app in cases of DDoS, SGs wouldn't help with that. It's like, the closer the questions end, the more trolls left.
  2. Denise123 👍 2 Answered B
    Tricky one. About option A > AWS WAF does not support Network Load Balancers (NLBs) directly. NLBs operate at the transport layer (Layer 4), while AWS WAF is designed to work with Application Load Balancers (ALBs) at the application layer (Layer 7).....Given that the requirement is to improve application security for a Network Load Balancer with minimal architectural changes, the most appropriate solution would be Option B
  3. FlyingHawk 👍 2 Answered B
    https://aws.amazon.com/blogs/containers/network-load-balancers-now-support-security-groups/
  4. GOTJ 👍 1 Answered B
    Several links below prove that option "B" is correct, regardless of the "NLB recreation" drawback. It's time to kick option C out (it was my first guess, I must confess) DDoS prevention, even though useful, is not required by the company. The company is interested SOLELY in prevent "unauthorized access" to the application. In the absence of more specific information, I came to the conclusion that the company detected some "weird ips" trying to access the application. After some investigation, I came to the conclusion that AWS Shield Advanced doesn't provide this feature for ips if they weren't previously involved in a DDoS attack. In an on-premises environment, I would setup a firewall rule with an allow list to accomplish this requirement, which is precisely what option "B" offers.
  5. ckhemani 👍 1 Answered B
    Real-time data processing normally use RTP Protocol which uses a range of ports to deliver audio and video streams. It doesn't specifically says HTTPS so i assume, it can't use WAF to control the traffic since it operates in HTTP/HTTPS Level only. Not designed for real-time: HTTP is primarily designed for request-response communication, which involves sending a request and then waiting for a full response, making it less efficient for continuous data streams needed in real-time applications
  6. mk168898 👍 1
    I don't think B is correct. if you only allow selected IPs to access then this company cannot host their video streaming service to the public. D should be the correct answer. AWS shield advanced if I rmb correctly prevent unauthorised attempts
  7. EllenLiu 👍 1 Answered B
    shield is only for DDos attacks protection
  8. AbhiBK 👍 3
    Answer is D
  9. ttttttttttttttttttttttt 👍 1 Answered A
    Why is it not A?
  10. komorebi 👍 1 Answered B
    Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Low-Latency Block Storage Multi-AZ Migration

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide