How to Provide Static IP Addresses for Network Load Balancer Whitelisting
A company is migrating a legacy application to AWS. The application requires a fixed IP address for whitelisting by a third-party service. The application will run on EC2 instances behind an Application Load Balancer. The company needs a solution that provides a static IP address for outbound traffic. What should a solutions architect do?
⚠ Common exam trap
The trap is confusing inbound and outbound static IP requirements; candidates may think an ALB can have an Elastic IP or that an NLB provides outbound static IPs, but only a NAT Gateway with an Elastic IP solves the outbound static IP need.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place the EC2 instances in a private subnet and route outbound traffic through a NAT Gateway with an Elastic IP.
Placing the EC2 instances in a private subnet and routing outbound traffic through a NAT Gateway with an Elastic IP provides a static IP address for outbound traffic. The third-party service whitelists this Elastic IP, and all outbound traffic from the instances will appear to originate from that IP. This is the standard AWS solution for providing static outbound IPs for instances behind an ALB, as ALBs do not support Elastic IPs and cannot provide a static IP for outbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the ALB with a Network Load Balancer and assign Elastic IPs.
Why it's wrong here
A Network Load Balancer terminates TCP at layer 4 and cannot inspect HTTP paths or host headers, so it cannot serve as the ALB the application's routing depends on. Elastic IPs on NLB nodes are the right answer only when layer 4 load balancing is acceptable.
- ✗
Assign an Elastic IP address to the Application Load Balancer.
Why it's wrong here
An Application Load Balancer operates at layer 7 and cannot hold an Elastic IP; its nodes use dynamic addresses, so outbound traffic still leaves via unpredictable IPs. Elastic IPs attach to instances or network interfaces, which is why they suit direct EC2 hosting rather than ALB-fronted egress.
- ✓
Place the EC2 instances in a private subnet and route outbound traffic through a NAT Gateway with an Elastic IP.
Why this is correct
A NAT Gateway performs source NAT, so all outbound traffic from the private subnet egresses via its attached Elastic IP. This satisfies the third-party whitelisting constraint, which requires a single, fixed public address rather than the dynamic addresses of instances or an internet gateway.
- ✗
Attach an Internet Gateway to the VPC and assign an Elastic IP to it.
Why it's wrong here
An Internet Gateway is a horizontally scaled, redundant VPC component that performs no address translation and cannot be assigned an Elastic IP. It is the correct attachment for enabling public routing, not for giving outbound traffic a fixed, whitelistable source address.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.