nerdexam
Amazon

SAA-C03 · Question #88

A company hosts a video streaming web application in a VPC. The company uses a Network Load Balancer (NLB) to handle TCP traffic for real-time data processing. There have been unauthorized attempts to

The correct answer is D. Use AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized. The company needs to improve the security of its video streaming application behind an NLB, specifically to prevent unauthorized access attempts, with minimal architectural changes.

Submitted by tarun92· Mar 4, 2026Design Secure Architectures

Question

A company hosts a video streaming web application in a VPC. The company uses a Network Load Balancer (NLB) to handle TCP traffic for real-time data processing. There have been unauthorized attempts to access the application. The company wants to improve application security with minimal architectural change to prevent unauthorized attempts to access the application. Which solution will meet these requirements?

Options

  • AImplement a series of AWS WAF rules directly on the NLB to filter out unauthorized traffic.
  • BRecreate the NLB with a security group to allow only trusted IP addresses.
  • CDeploy a second NLB in parallel with the existing NLB configured with a strict IP address allow
  • DUse AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorized

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    14% (3)
  • D
    77% (17)

Why each option

The company needs to improve the security of its video streaming application behind an NLB, specifically to prevent unauthorized access attempts, with minimal architectural changes.

AImplement a series of AWS WAF rules directly on the NLB to filter out unauthorized traffic.

AWS WAF cannot be directly integrated with a Network Load Balancer (NLB) because NLBs operate at Layer 4 (TCP/UDP), while WAF operates at Layer 7 (HTTP/HTTPS).

BRecreate the NLB with a security group to allow only trusted IP addresses.
CDeploy a second NLB in parallel with the existing NLB configured with a strict IP address allow
DUse AWS Shield Advanced to provide enhanced DDoS protection and prevent unauthorizedCorrect

AWS Shield Advanced provides enhanced DDoS protection at layers 3 and 4, which is applicable to a Network Load Balancer (NLB) and can help prevent various unauthorized attempts or volumetric attacks. This service can be integrated without fundamental architectural changes to the existing NLB setup.

Concept tested: Network Load Balancer security limitations, DDoS protection

Source: https://docs.aws.amazon.com/shield/latest/dg/what-is-shield.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAA-C03 Practice