A company is deploying a non-web application on an AWS load balancer. All targets are servers located on-premises that can be accessed by using AWS…

A Network Load Balancer (NLB) is the appropriate choice for a non-web (Layer 4) application. When an NLB routes traffic to on-premises targets via AWS Direct Connect, it acts as a proxy, and by default, the on-premises server sees the NLB's private IP address as the source. To preserve the original client IP address in this scenario, you must enable Proxy Protocol on the NLB's target group. The NLB then prepends a Proxy Protocol v2 header to the TCP connection, which contains the original client connection information, including the source IP. The on-premises application must be configured to parse this header to retrieve the client's IP address.

A. This is incorrect because an NLB only preserves the source IP automatically for targets within its VPC (registered by instance ID or IP). For on-premises targets, it does not.

B. The X-Forwarded-For header is an HTTP (Layer 7) concept used by Application Load Balancers. A Network Load Balancer operates at Layer 4 and does not process or add HTTP headers.

D. An Application Load Balancer is designed for web traffic (HTTP/HTTPS) and is unsuitable for a generic non-web application. It would be the wrong type of load balancer for this use case.

1. AWS Documentation: Elastic Load Balancing User Guide for Network Load Balancers - Source IP addresses.

Under the section "Client IP address preservation," it states: "When you register targets by IP address, the source IP addresses of the clients are preserved for targets in the load balancer VPC... For targets in a peered VPC, on-premises (through a VPN or AWS Direct Connect)... the source IP addresses of the clients are the private IP addresses of the load balancer nodes. If you need the client IP addresses, enable proxy protocol..." This directly refutes option A and supports option C for the on-premises scenario.

2. AWS Documentation: Elastic Load Balancing User Guide for Network Load Balancers - Proxy protocol.

The guide explains, "You can enable Proxy protocol on your load balancer and then get the client's connection information from the header that is added to the request." It further details that the Proxy Protocol v2 header includes the source IP address, destination IP address, source port, and destination port. This confirms that enabling Proxy Protocol (specifically v2 for NLB) is the correct mechanism.

3. AWS Documentation: Elastic Load Balancing User Guide for Application Load Balancers - Request routing.

This document describes how ALBs handle requests, stating, "Application Load Balancers support the X-Forwarded-For... headers." This confirms that X-Forwarded-For is an ALB feature, making options B and D incorrect in the context of an NLB or a non-web application.