How to Capture Client Public IP Addresses Behind an ALB?
Short answer
D Add an X-Forwarded-For header to the HTTP server log configuration file.
Question
Key Takeaways
This question tests your understanding of how ALB forwards client IP information via the X-Forwarded-For header, not through agents or daemons. The trap is mistaking logging configuration with monitoring tools.
To capture client public IP addresses for EC2 instances behind an Application Load Balancer, you must configure the HTTP server log to include the X-Forwarded-For header. The community unanimously confirms that option D is correct, as the ALB uses this header to preserve the original client IP.
Common mistake: Choosing B (CloudWatch Logs agent) or C (X-Ray daemon) because they seem related to logging, but neither injects the original client IP into HTTP server logs; they only forward existing log data or trace requests separately.
Expert Analysis
Why the Answer Is Correct
When traffic flows through an Application Load Balancer, the ALB terminates the TCP connection from the client and establishes a new connection to the target EC2 instance. Therefore, the web server on the EC2 instance sees the ALB's private IP address as the source IP. To preserve the original client IP, the ALB automatically adds the X-Forwarded-For header to each HTTP request. By adding this header to the HTTP server log configuration, the developer can record the actual client public IP address. This is a standard practice for logging behind load balancers.
Why the Other Options Are Wrong
Option A (Host header) is incorrect because the Host header contains the domain name of the request, not the client IP. Option B (CloudWatch Logs agent) is a monitoring and log delivery service; it does not alter the content of the log file or add the client IP to the HTTP server logs. Option C (X-Ray daemon) is used for distributed tracing and does not modify web server logs to include the client IP. Only the X-Forwarded-For header provides the required information.
Community Comment Notes
Comments [1] and [2] explicitly state that X-Forwarded-For is used to capture the original client IP address when requests are routed through an ALB. Comment [1] also highlights that the ALB is the source of this header, reinforcing that the fix is a logging configuration change. The consensus (100% votes for D) aligns with AWS documentation and standard load balancer behavior.
Official Reference
- https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-request-routing.html
- https://docs.aws.amazon.com/elasticloadbalancing/latest/application/how-elastic-load-balancing-works.html
- https://docs.aws.amazon.com/athena/latest/ug/application-load-balancer-logs.html
These links open the official vendor documentation in a new tab.
Exam Strategy
Remember that ALB inserts X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port headers. When a question about client IP or protocol behind a load balancer appears, immediately think of these headers rather than agents or daemons. Also note that for Network Load Balancers, the source IP is preserved directly unless you use target groups with instance IPs, which can be a related but distinct concept.
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →
X-Forwarded-Forheader is used to capture the original client IP address when requests are routed through a load balancer like the ALB.