[Governance, Risk, and Compliance (GRC)] An auditor is reviewing the logs from a web application to determine the source of an incident. The web…

The web server logs indicate that all incoming requests originate from the IP address 192.168.1.10, which is the internal IP of the application load balancer. This configuration masks the true source IP address of the external client, making incident tracing impossible. The X-Forwarded-For (XFF) HTTP header is a standard mechanism used by proxies and load balancers to carry the original client's IP address. By enabling the load balancer to add this header to requests it forwards, and configuring the web servers to log this header's value, the true source IP can be recorded, allowing for effective incident tracing.

B. A HIDS on the application servers would still only see traffic originating from the web servers' IPs, not the original external client, failing to solve the source tracing problem.

C. Installing a trusted certificate addresses an unrelated issue with TLS/SSL trust noted in the database logs; it does not affect the logging of client source IP addresses.

D. Using stored procedures is a database security best practice to prevent attacks like SQL injection but has no impact on how web servers log incoming connection information.

E. The $SERVER['REMOTEADDR'] variable (or its equivalent) is already being used, and it correctly captures the IP of the load balancer, which is the source of the problem.

1. Amazon Web Services (AWS) Documentation. HTTP headers and Application Load Balancers. "The X-Forwarded-For request header helps you identify the IP address of a client when you use an HTTP or HTTPS load balancer. Because load balancers intercept traffic between clients and servers

your server access logs contain the IP address of the load balancer only." Retrieved from the Elastic Load Balancing User Guide.

2. Internet Engineering Task Force (IETF). RFC 7239: Forwarded HTTP Extension

Section 4. This RFC

which standardizes the Forwarded header

acknowledges the common

non-standard use of the X-Forwarded-For header for the same purpose: "The X-Forwarded-For header field is a de facto standard for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer."

3. The NGINX Plus Admin Guide. Using the X-Forwarded-For Header. "To pass the client’s IP address to the backend servers

you need to use the X-Forwarded-For header. The proxysetheader directive is used to do this." This official vendor documentation outlines the exact configuration needed to solve the scenario's problem.

4. University of Washington

Paul G. Allen School of Computer Science & Engineering. CSE 481S: Capstone: Systems and Networking

Lecture 12: Scalability. The course material on load balancing explicitly states the problem and solution: "Problem: backend servers only see the load balancer’s IP. Solution: X-Forwarded-For header."