SAP-C02 Design for New Solutions Practice Question
A company is designing a highly available application on AWS that uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application requires that the client's IP address be preserved in the application logs. The company also needs to perform SSL termination at the load balancer. How should the company configure the ALB to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse TCP listeners with proxy protocol v2 as the only way to preserve client IP, overlooking that HTTPS listeners automatically provide the X-Forwarded-For header for client IP preservation when SSL termination is performed at the load balancer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 80. Enable X-Forwarded-For header.
Using an HTTPS listener on port 443 with SSL termination at the ALB allows the load balancer to decrypt traffic and forward it as HTTP on port 80. The X-Forwarded-For header is automatically added by the ALB to preserve the original client IP address in the application logs, meeting both requirements without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use TCP listener on port 443 and forward to instances on port 80. Enable proxy protocol v2.
Why it's wrong here
Network Load Balancer would be needed for TCP, but ALB is required for HTTP features.
- ✗
Use TCP listener on port 443 and forward to instances on port 443. Install SSL certificate on instances.
Why it's wrong here
SSL termination on instances adds management overhead and does not preserve client IP in logs unless configured.
- ✗
Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 443. Disable proxy protocol.
Why it's wrong here
Instances would need to handle SSL again, and client IP may not be preserved.
- ✓
Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 80. Enable X-Forwarded-For header.
Why this is correct
ALB terminates SSL and passes client IP via X-Forwarded-For.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.