How to Capture Client Public IP Addresses Behind an ALB?
A developer is writing an application to analyze the traffic to a fleet of Amazon EC2 instances. The EC2 instances run behind a public Application Load Balancer (ALB). An HTTP server runs on each of the EC2 instances, logging all requests to a log file. The developer wants to capture the client public IP addresses. The developer analyzes the log files and notices only the IP address of the ALB. What must the developer do to capture the client public IP addresses in the log file?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests your understanding of how ALB forwards client IP information via the X-Forwarded-For header, not through agents or daemons. The trap is mistaking logging configuration with monitoring tools.
To capture client public IP addresses for EC2 instances behind an Application Load Balancer, you must configure the HTTP server log to include the X-Forwarded-For header. The community unanimously confirms that option D is correct, as the ALB uses this header to preserve the original client IP.
Choosing B (CloudWatch Logs agent) or C (X-Ray daemon) because they seem related to logging, but neither injects the original client IP into HTTP server logs; they only forward existing log data or trace requests separately.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
When traffic flows through an Application Load Balancer, the ALB terminates the TCP connection from the client and establishes a new connection to the target EC2 instance. Therefore, the web server on the EC2 instance sees the ALB's private IP address as the source IP. To preserve the original client IP, the ALB automatically adds the X-Forwarded-For header to each HTTP request. By adding this header to the HTTP server log configuration, the developer can record the actual client public IP address. This is a standard practice for logging behind load balancers.
Why the Other Options Are Wrong
Option A (Host header) is incorrect because the Host header contains the domain name of the request, not the client IP. Option B (CloudWatch Logs agent) is a monitoring and log delivery service; it does not alter the content of the log file or add the client IP to the HTTP server logs. Option C (X-Ray daemon) is used for distributed tracing and does not modify web server logs to include the client IP. Only the X-Forwarded-For header provides the required information.
Community Comment Notes
Comments [1] and [2] explicitly state that X-Forwarded-For is used to capture the original client IP address when requests are routed through an ALB. Comment [1] also highlights that the ALB is the source of this header, reinforcing that the fix is a logging configuration change. The consensus (100% votes for D) aligns with AWS documentation and standard load balancer behavior.
Official Reference
Exam Strategy
Remember that ALB inserts X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port headers. When a question about client IP or protocol behind a load balancer appears, immediately think of these headers rather than agents or daemons. Also note that for Network Load Balancers, the source IP is preserved directly unless you use target groups with instance IPs, which can be a related but distinct concept.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →
X-Forwarded-Forheader is used to capture the original client IP address when requests are routed through a load balancer like the ALB.