SOA-C02 Networking and Content Delivery Practice Question

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB terminates SSL/TLS and forwards traffic to the instances over HTTP. The SysOps administrator needs to capture the original client IP address in the instance logs. How should the administrator configure this?

⚠ Common exam trap

Many candidates confuse Proxy Protocol v2 (used for NLB TCP/UDP listeners) with the X-Forwarded-For header (used for ALB HTTP/HTTPS listeners), leading them to select option C even though it is not applicable to ALB's HTTP-based forwarding.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable the X-Forwarded-For header on the ALB.

When an Application Load Balancer terminates SSL/TLS and forwards traffic to EC2 instances over HTTP, the original client IP address is preserved by the ALB in the X-Forwarded-For header. By enabling this header on the ALB, the SysOps administrator ensures that the web server or application can log the true client IP, which is essential for analytics, security, and troubleshooting.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable stickiness on the ALB target group.
Why it's wrong here
Enabling stickiness (session affinity) on the ALB target group uses cookies or the application's session to route all requests from a given client to the same EC2 instance, but it does not alter or inject the client's IP address into the request. The EC2 instance still sees the ALB's private IP as the source address in the TCP connection, so application logs would record the load balancer's IP, not the original client. Stickiness only ensures session consistency; it is unrelated to capturing client IP information for logs.
✓
Enable the X-Forwarded-For header on the ALB.
Why this is correct
The ALB automatically adds the X-Forwarded-For header to each HTTP/HTTPS request as it passes through, containing the original client IP address in a comma-separated list. Since the ALB terminates the client's TLS connection and opens a new connection to the target, the EC2 instance must read this header to record the client IP in its logs. By default, the ALB overwrites any existing X-Forwarded-For header to prevent client spoofing, and you should configure your web server or application to log the first IP in the header, which is the true client IP.
✗
Configure the ALB to use Proxy Protocol v2.
Why it's wrong here
Proxy Protocol v2 is a transport-level protocol that prepends a human-readable header to preserve the original client IP, but it is a feature supported by Network Load Balancers, not Application Load Balancers. ALBs operate at Layer 7 and use the X-Forwarded-For HTTP header instead, and they do not offer a Proxy Protocol enablement option in their configuration. Since the question specifically involves an ALB, enabling Proxy Protocol is not a valid action; even if it were available, it would not align with ALB's HTTP-based forwarding architecture.
✗
Enable access logs on the ALB and store them in Amazon S3.
Why it's wrong here
Access logs capture detailed information about requests sent to the ALB, including client IP, but they are stored in S3, not available directly on the EC2 instances. The requirement is to capture the IP in instance logs.

Go deeper

SOA-C02 Networking and Content Delivery Practice Question

Why each option matters

Option-by-option breakdown

Related to this question