The answer is to use the Network Load Balancer’s default behavior, as no additional configuration is needed to preserve the source IP. This works because an NLB operates at Layer 4, forwarding TCP packets directly to the target without terminating the connection, so the backend instance sees the original client IP address in the packet headers. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this concept tests your understanding of the fundamental difference between Layer 4 and Layer 7 load balancers—a common trap is confusing NLB with Application Load Balancer, which does terminate connections and requires X-Forwarded-For headers. Remember that NLBs are transparent to the TCP handshake, meaning the client IP is always preserved by default for TCP traffic. A quick memory tip: “NLB: No Loss of IP, By Default.”
SOA-C02 Networking and Content Delivery Practice Question
This SOA-C02 practice question tests your understanding of networking and content delivery. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A SysOps Administrator is configuring a Network Load Balancer (NLB) for a TCP-based application. The application requires that clients see the original source IP address of the request. Which configuration should the Administrator use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the NLB default behavior; no additional configuration needed.
Network Load Balancers (NLBs) preserve the original source IP address of clients by default when forwarding TCP traffic to targets. This is because NLBs operate at Layer 4 and do not terminate the TCP connection; instead, they pass packets directly to the backend, allowing the target to see the client's IP. No additional configuration is required for this behavior.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use the NLB default behavior; no additional configuration needed.
Why this is correct
NLB preserves the client source IP by default for TCP/UDP traffic.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use an Application Load Balancer instead, which preserves the source IP.
Why it's wrong here
Application Load Balancer does not preserve the source IP; it uses X-Forwarded-For header.
✗
Enable cross-zone load balancing on the NLB.
Why it's wrong here
Cross-zone load balancing distributes traffic across zones but does not affect source IP preservation.
✗
Enable Proxy Protocol v2 on the target group.
Why it's wrong here
Proxy Protocol adds a header but is not necessary if you just need the source IP; NLB preserves source IP by default.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse NLB and ALB behavior, assuming that preserving source IP requires a special configuration like Proxy Protocol, when in fact NLBs do this by default for TCP traffic.
Detailed technical explanation
How to think about this question
NLBs preserve source IP by using a transparent proxy model where the backend targets receive packets with the original client IP and port intact, as the NLB does not perform Network Address Translation (NAT) on the source address. This is defined in RFC 1918 and is inherent to Layer 4 load balancing. In contrast, ALBs act as reverse proxies, terminating the TCP connection and initiating a new one, which changes the source IP unless you explicitly enable Proxy Protocol or use target group attributes to preserve client IP.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Networking and Content Delivery — This question tests Networking and Content Delivery — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use the NLB default behavior; no additional configuration needed. — Network Load Balancers (NLBs) preserve the original source IP address of clients by default when forwarding TCP traffic to targets. This is because NLBs operate at Layer 4 and do not terminate the TCP connection; instead, they pass packets directly to the backend, allowing the target to see the client's IP. No additional configuration is required for this behavior.
What should I do if I get this SOA-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.