How to Get a Static IP for an Application Load Balancer on AWS
A company is migrating a legacy application to AWS that requires a static IP address for client whitelisting. The application will run on EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure the IP address does not change over time. What should the company do?
Quick Answer
The answer is to use a Network Load Balancer (NLB) with an Elastic IP address. This is correct because the NLB operates at Layer 4 and allows you to assign a static Elastic IP directly to each of its Availability Zone subnets, ensuring the IP address does not change over time. The NLB can then forward traffic to the Application Load Balancer (ALB) or directly to EC2 instances, preserving the existing application architecture while meeting the client whitelisting requirement. On the AWS Certified SAP on AWS Specialty PAS-C01 exam, this scenario tests your understanding of how to combine load balancer types to satisfy both static IP needs and Layer 7 routing—a common trap is assuming an ALB can be given a static IP, which it cannot. A useful memory tip: think of the NLB as the "fixed front door" with an Elastic IP, and the ALB as the "smart router" behind it.
⚠ Common exam trap
It's easy for candidates to choose Global Accelerator because it offers static IPs, but they overlook that an NLB with Elastic IPs is the simpler, cost-effective solution for a single-region static IP requirement, and Global Accelerator is intended for global traffic acceleration, not just static IP assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Network Load Balancer (NLB) with an Elastic IP address
A Network Load Balancer (NLB) supports static IP addresses by allowing you to assign Elastic IPs directly to each of its Availability Zone subnets. This provides fixed IP endpoints for client whitelisting, while the NLB can forward traffic to the EC2 instances behind an ALB, preserving the application's architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign an Elastic IP to each EC2 instance
Why it's wrong here
Clients would need to whitelist multiple IPs, and instances behind ALB are not directly accessed.
- ✗
Use Route 53 latency-based routing to point to the ALB
Why it's wrong here
ALB DNS name resolves to dynamic IPs; not suitable for static whitelisting.
- ✗
Use AWS Global Accelerator to get two static IP addresses
Why it's wrong here
AWS Global Accelerator offers static Anycast IP addresses, which are tempting as they provide a fixed entry point for clients. However, these IPs are for Global Accelerator itself, acting as a global front for endpoints like ALBs, not providing a static public IP *for the ALB directly*. An ALB's internet-facing IP addresses are dynamic and can change. Global Accelerator is ideal for optimising global traffic routing to the nearest healthy endpoint, or providing static IPs when multiple regional endpoints are involved, but it does not assign a single static public IP to a specific ALB for direct whitelisting.
- ✓
Use a Network Load Balancer (NLB) with an Elastic IP address
Why this is correct
NLB supports static IP via Elastic IP, which can be whitelisted.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is migrating a legacy application to AWS. The application requires a static IP address that must not change after migration. Which networking component should be used to ensure the application's public IP remains consistent?
medium- ✓ A.Elastic IP address
- B.Internet Gateway
- C.VPC Peering
- D.NAT Gateway
Why A: An Elastic IP address is a static public IPv4 address that can be associated with an EC2 instance or a Network Load Balancer, ensuring the application's public IP remains consistent. Option B (Internet Gateway) is used for VPC internet access but does not provide a static IP. Option C (VPC Peering) is for connecting VPCs. Option D (NAT Gateway) is for outbound traffic.
Variation 2. An organization is migrating a legacy application to AWS. The application requires a static IP address for client whitelisting. After migrating the application to an Application Load Balancer (ALB) with an Auto Scaling group, clients report connection failures. What should be done to resolve this issue?
hard- A.Place an Nginx reverse proxy in front of the ALB with an Elastic IP.
- B.Assign an Elastic IP to the ALB.
- C.Configure the ALB to use a round-robin routing algorithm.
- ✓ D.Replace the ALB with a Network Load Balancer (NLB) and assign an Elastic IP.
Why D: The correct solution is to replace the ALB with a Network Load Balancer (NLB) and assign an Elastic IP. ALBs do not have static IP addresses; they use dynamic IPs that can change. NLBs support Elastic IPs, providing a fixed IP for client whitelisting. Option A is incorrect because adding an Nginx reverse proxy introduces unnecessary complexity and still requires a static IP. Option B is wrong because you cannot assign an Elastic IP to an ALB. Option C is incorrect because the routing algorithm does not affect the IP address; the ALB's IPs remain dynamic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.