ALB Query String Routing and ACM Encryption

SAA-C03 By islever Editorial Last updated

Determine high-performing and/or scalable network architectures.

Short answer

C Use an Application Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.

Question

A robotics company is designing a solution for medical surgery. The robots will use advanced sensors, cameras, and AI algorithms to perceive their environment and to complete surgeries. The company needs a public load balancer in the AWS Cloud that will ensure seamless communication with backend services. The load balancer must be capable of routing traffic based on the query strings to different target groups. The traffic must also be encrypted. Which solution will meet these requirements?
  1. Use a Network Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.
  2. Use a Gateway Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use HTTP path-based routing.
  3. Use an Application Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing. Correct Answer
  4. Use a Network Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use query parameter-based routing.

Key Takeaways

The question tests knowledge of Layer 7 vs Layer 4 load balancer features; the common trap is confusing Network Load Balancer's low-latency capabilities with ALB's advanced content-based routing.

This question tests the specific routing capabilities of AWS load balancers, focusing on how to route traffic based on query strings while ensuring encryption. It establishes that only the Application Load Balancer (ALB) supports Layer 7 content-based routing including query parameters.

Common mistake: Many candidates choose Network Load Balancer (NLB) because it handles high throughput and encryption via TLS, but they overlook that NLB cannot inspect or route traffic based on HTTP query strings.

Expert Analysis

Why the Answer Is Correct

Option C is correct because the Application Load Balancer (ALB) operates at Layer 7 (Application Layer) and natively supports content-based routing, including routing decisions based on query string parameters. Additionally, ALB integrates seamlessly with AWS Certificate Manager (ACM) to terminate SSL/TLS connections, satisfying the requirement for encrypted traffic.

Why the Other Options Are Wrong

Network Load Balancer (NLB) and Gateway Load Balancer operate primarily at Layer 4 (Transport Layer) or use custom protocols; they do not parse HTTP headers or query strings for routing decisions. Furthermore, NLBs typically use IAM certificates for TLS termination in some configurations, but the critical failure is the inability to route based on query parameters. Option B uses path-based routing instead of query parameter routing, which does not meet the specific requirement.

Community Comment Notes

Community consensus strongly supports Option C. Users noted that "only ALB can route traffic based on query parameter" and that NLB cannot process such parameters. One commenter emphasized that neither NLB nor Gateway LB supports query parameter-based routing, confirming ALB as the only viable choice for this Layer 7 requirement.

Exam Strategy

Always map the routing criteria to the OSI layer: if the decision involves HTTP methods, paths, headers, or query strings, you must use an Application Load Balancer. If the requirement is just TCP/UDP or lowest latency, consider NLB.

Frequently Asked Questions

Why can't Network Load Balancer route by query string?

NLB operates at Layer 4 (TCP/UDP) and does not inspect HTTP payload content like query strings. Only ALB (Layer 7) can perform this inspection.

Is IAM certificate support available for ALB?

While ALB can use IAM certificates, AWS recommends using ACM for easier management and automatic renewal. The key differentiator here is the routing capability, not just the cert source.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. TruthWS 👍 6
    Option C - parameter is not a thing NLB can process
  2. Scheldon 👍 4 Answered C
    AnswerC I was thinking that it will be network LB but after checks it occurs that only Application LB is able to redirect/forward traffic based on query string. and for encrypted traffic ACM is needed We recommend that you create certificates for your load balancer using AWS Certificate Manager (ACM). ACM supports RSA certificates with 2048, 3072, and 4096-bit key lengths, and all ECDSA certificates. ACM integrates with Elastic Load Balancing so that you can deploy the certificate on your load balancer. For more information, see the AWS Certificate Manager User Guide. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#rule-condition-types https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html
  3. alawada 👍 3 Answered C
    Provision an Application Load Balancer (ALB) in the AWS Cloud. ALB is a Layer 7 load balancer that supports advanced routing features, including path-based routing.
  4. mk168898 👍 2 Answered C
    only ALB can route traffic based on query parameter, NLB cannot. So C
  5. LeonSauveterre 👍 1 Answered C
    Neither Network Load Balancer nor Gateway Load Balancer supports query parameter-based routing.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide