How to Provide Static IP Addresses for Network Load Balancer Whitelisting
A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by external partners. The company will use a Network Load Balancer (NLB) to distribute traffic to EC2 instances. Which TWO actions should the company take to provide static IP addresses for the partners to whitelist?
Quick Answer
The answer is to use AWS Global Accelerator with the NLB as an endpoint and to assign Elastic IP addresses directly to the NLB. This works because Global Accelerator provides two static IP addresses that act as a fixed entry point, while assigning Elastic IPs to the NLB itself gives you dedicated, static public IPs for whitelisting—both approaches ensure the IPs do not change, unlike the dynamic IPs of an NLB’s nodes. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of how to decouple static IP requirements from underlying infrastructure, often appearing as a trap where candidates mistakenly try to attach Elastic IPs to EC2 instances behind the NLB (which is unsupported) or use an Application Load Balancer. A key memory tip: think “Global Accelerator gives you two static IPs for any regional endpoint,” and remember that Elastic IPs attach to the NLB, not the instances—so “NLB gets the EIP, instances stay private.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Elastic IP addresses to the Network Load Balancer.
You can assign Elastic IP addresses to the Network Load Balancer per Availability Zone, providing static IPs for external partners to whitelist. Option E is correct because AWS Global Accelerator provides two static IP addresses (or allows you to bring your own) and can be used with an NLB as an endpoint, offering static IPs that partners can whitelist. Option A is incorrect because attaching Elastic IPs to EC2 instances does not provide static IPs for the NLB frontend; the NLB uses its own IPs. Option C is incorrect because an Application Load Balancer (ALB) does not support static IP addresses by default and operates at layer 7, not suitable for this requirement. Option D is incorrect because AWS WAF is a web application firewall that filters traffic based on rules but does not provide static IP addresses for the load balancer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Elastic IP to each EC2 instance.
Why it's wrong here
Instances behind NLB should not have public IPs; NLB handles traffic.
- ✓
Assign Elastic IP addresses to the Network Load Balancer.
Why this is correct
NLB supports Elastic IP per AZ, providing static IPs.
- ✗
Configure an Application Load Balancer instead of NLB.
Why it's wrong here
ALB does not support Elastic IP assignment.
- ✗
Use AWS WAF to allow traffic from the partners' IP ranges.
Why it's wrong here
WAF does not provide static IPs for the NLB.
- ✓
Use AWS Global Accelerator with the NLB as an endpoint.
Why this is correct
Global Accelerator provides two static IPs that route to the NLB.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is migrating a legacy application to AWS. The application requires a fixed IP address for whitelisting by a third-party service. The application will run on EC2 instances behind an Application Load Balancer. The company needs a solution that provides a static IP address for outbound traffic. What should a solutions architect do?
hard- A.Replace the ALB with a Network Load Balancer and assign Elastic IPs.
- B.Assign an Elastic IP address to the Application Load Balancer.
- ✓ C.Place the EC2 instances in a private subnet and route outbound traffic through a NAT Gateway with an Elastic IP.
- D.Attach an Internet Gateway to the VPC and assign an Elastic IP to it.
Why C: A NAT Gateway in a public subnet with an Elastic IP provides a static IP for outbound traffic from instances in private subnets. This allows the third-party service to whitelist that IP address. Option A is incorrect because replacing the ALB with an NLB would affect inbound traffic handling and does not solve outbound static IP requirements. Option B is incorrect because an Application Load Balancer cannot be assigned an Elastic IP; it uses dynamic IP addresses. Option D is incorrect because an Internet Gateway does not provide a static IP; it allows communication between VPC and internet but does not source traffic from a fixed IP.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.