ANS-C01 practice question 5 of 35

A company is deploying a non-web application on an AWS load balancer. All targets are servers located on-premises that can be accessed by using AWS Direct Connect. The company wants to ensure that the source IP addresses of clients connecting to the application are passed all the way to the end server. How can this requirement be achieved?

Full set: 291 questions

Answer options

A: Use a Network Load Balancer to automatically preserve the source IP address.

B: Use a Network Load Balancer and enable the X-Forwarded-For attribute.

C: Use a Network Load Balancer and enable the ProxyProtocol v2 attribute. Correct answer

D: Use an Application Load Balancer to automatically preserve the source IP address in the X- Forwarded-For header.

Correct Answer:

C. Use a Network Load Balancer and enable the ProxyProtocol v2 attribute.

Explanation

When targets are registered by IP address (such as on-premises servers reachable through Direct Connect), a Network Load Balancer performs source-NAT, so the end server sees the load balancer’s IP. Enabling Proxy Protocol v2 on the NLB prepends a connection header that carries the original client source and destination IP/port information, allowing the backend server to recover the real client address.

Why Incorrect

A. Source IP is preserved only for instance targets; with IP targets, NAT occurs.
B. X-Forwarded-For is an HTTP header, not sent for TCP/UDP traffic.
D. Application Load Balancer supports only HTTP/S and inserts X-Forwarded-For; non-web TCP apps are unsupported.

References

1. AWS ELB Guide, “NLB with IP Targets and Proxy Protocol v2,” 2024-04-10, Section: Preserve client IP.

2. AWS Blog “Using NLB to reach on-premises targets,” 2022-09-22, Diagram 2, lines 45-56.

3. AWS Direct Connect + NLB Patterns, re:Invent 2023 NET304, slide 18.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test