Route 53 ALB Listener Rule for Dev Instance Access

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group that contains the development instance.

Question

A solutions architect runs a web application on multiple Amazon EC2 instances that are in individual target groups behind an Application Load Balancer (ALB). Users can reach the application through a public website. The solutions architect wants to allow engineers to use a development version of the website to access one specific development EC2 instance to test new features for the application. The solutions architect wants to use an Amazon Route 53 hosted zone to give the engineers access to the development instance. The solution must automatically route to the development instance even if the development instance is replaced. Which solution will meet these requirements?
  1. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group that contains the development instance. Correct Answer
  2. Recreate the development instance with a public IP address. Create an A Record for the development website that has the value set to the public IP address of the development instance.
  3. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB to redirect requests for the development website to the public IP address of the development instance.
  4. Place all the instances in the same target group. Create an A Record for the development website. Set the value to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group.

Key Takeaways

The core concept is leveraging ALB listener rules to direct traffic based on domain names, avoiding manual DNS updates when underlying instances change.

This question addresses how to route specific traffic to a development environment using an Application Load Balancer and Route 53. It establishes that listener rules on the ALB provide the necessary isolation and automation.

Common mistake: Option B is incorrect because it relies on a static public IP address, which fails the requirement for automatic routing upon instance replacement.

Expert Analysis

Why the Answer Is Correct

Option A correctly uses an Application Load Balancer (ALB) as the entry point via a Route 53 A record. By creating a listener rule that matches the development hostname, the ALB can forward traffic to a dedicated target group containing only the development instance. This architecture ensures that if the development instance is replaced, the new instance is registered in the target group, and the ALB automatically routes traffic to it without any DNS changes.

Why the Other Options Are Wrong

Option B creates a single A record pointing directly to the EC2 instance's public IP. This violates the requirement for automatic routing because public IPs are dynamic; replacing the instance requires manually updating the DNS record. Option C suggests redirecting to a public IP, which is inefficient and still suffers from the same static IP issue as B. Option D places all instances in one target group, meaning the listener rule cannot isolate development traffic from production traffic, leading to engineers potentially accessing production data.

Community Comment Notes

Community consensus strongly favors Option A. Users note that Option A is cleaner and simpler than Option C, which involves unnecessary redirection. Commenters highlight that pointing directly to an IP (Option B) breaks the 'automatic' requirement, while Option D lacks the necessary traffic isolation between dev and prod environments.

Exam Strategy

Always look for managed services like ALBs or CloudFront when you need to decouple DNS from underlying infrastructure changes. If the requirement mentions 'automatic' handling of instance replacements, avoid options that reference static IP addresses.

Frequently Asked Questions

Why not use a CNAME record instead of A record?

While CNAME is often preferred for ALBs, AWS allows A records (alias records) for root domains or when specifically configured. The question focuses on the routing logic, not the record type nuance.

Can I use Network Load Balancer here?

NLB does not support path-based or host-based listener rules in the same flexible way ALB does for HTTP/HTTPS content switching. ALB is the standard choice for this scenario.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Mikado211 👍 7
    Both A and C look correct but with the C you pass through the ALB to be redirected to a public IP (so go outside) to come back again through this public IP which is not ideal. The answer A is much cleaner and simplier with a dedicated target group and a listener rule pointing it.
  2. gdf54634 👍 6 Answered A
    Should be A as it points to the target group for easy replacement etc
  3. Scheldon 👍 3 Answered A
    AnswerA, With ALB which will point to appopriate dev group we will be able easy to create HA for dev servers.
  4. Cpso 👍 2 Answered A
    A.But not totally correct. ALB IP can be change. should use CNAME record.
  5. LeonSauveterre 👍 1 Answered A
    B - If the development instance is replaced, the public IP address changes, requiring manual DNS updates in Route 53. C - The ALB listener rule cannot directly redirect traffic based on the instance's public IP address without using a target group. D - Without traffic isolation, you could easily route requests for the development website to production instances. Dangerous and just plain wrong.
Show 2 more comments
  1. JA2018 👍 1 Answered A
    By setting the A Record to point to the ALB, you ensure that even if the development instance is replaced, the DNS record will still direct traffic to the correct target group which contains the new development instance, maintaining accessibility for engineers.
  2. asdfcdsxdfc 👍 2 Answered A
    I think its A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide