Which Load Balancer Provides a Static IP for Client Whitelisting?

SAA-C03 By islever Editorial Last updated Oct 12, 2026

Determine high-performing and/or scalable network architectures. Design highly available and/or fault-tolerant architectures.

Short answer

A Use a Network Load Balancer with an associated Elastic IP address so firewall-restricted clients can whitelist a static IP.

Question

A company is designing a new web service that will run on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. However, many of the web service clients can only reach IP addresses authorized on their firewalls. What should a solutions architect recommend to meet the clients’ needs?

A Network Load Balancer with an associated Elastic IP address. Correct Answer
An Application Load Balancer with an associated Elastic IP address.
An A record in an Amazon Route 53 hosted zone pointing to an Elastic IP address.
An EC2 instance with a public IP address running as a proxy in front of the load balancer.

Key Takeaways

The exam tests ELB type selection for static IP whitelisting, and the trap is assuming an Application Load Balancer or Route 53 record can provide the static address clients must authorize.

This SAA-C03 question tests how to give firewall-restricted clients a static IP for an EC2 web service behind an ELB. The correct design is a Network Load Balancer with an associated Elastic IP address, because NLB supports static IPs while ALB does not.

Common mistake: A frequent error is choosing an Application Load Balancer with an Elastic IP; ALB nodes do not support Elastic IPs, so clients cannot whitelist a stable address.

Expert Analysis

Why the Answer Is Correct

A Network Load Balancer (NLB) is the only ELB type that supports static IP addresses, including one Elastic IP per enabled Availability Zone. Because the clients can only reach IPs already authorized on their firewalls, the web service must present a stable, known address that administrators can add to those allowlists. Associating an Elastic IP with the NLB gives the service a static public IP that survives NLB node replacement and scaling. This satisfies the requirement without adding an extra proxy tier or relying on DNS resolution.

Why the Other Options Are Wrong

An Application Load Balancer cannot be assigned an Elastic IP address; its nodes use dynamic IPs, so clients would have no fixed address to authorize. A Route 53 A record pointing to an Elastic IP does not attach that IP to the ELB, so the web service would not actually be reachable at the whitelisted address. An EC2 proxy in front of the load balancer could expose a public IP, but it adds an unnecessary hop, a potential single point of failure, and does not provide the managed static-IP capability of an NLB. Option D also misplaces the load-balancing function and complicates health checks and scaling.

Community Comment Notes

Several learners, including alawada, cite AWS documentation that NLB supports static IP addresses for the load balancer and connect that to client whitelisting. BillaRanga explains that an ALB cannot be assigned an Elastic IP and questions how a Route 53 record with an "associated elastic IP" would work, which aligns with why B and C fail. A learner referencing a Udemy practice test notes that NLB must sit in front of ALB when a static IP is required, though here there is no ALB requirement. FlyingHawk argues both A and C are correct, but the Route 53 A record alone does not give the ELB the static IP the clients must authorize. 67a3f49 reinforces that this is a standard NLB static-IP scenario.

Official Reference

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When clients whitelist fixed IPs, eliminate options that rely on ALB or DNS-only records before comparing features. NLB is the ELB type to remember for static IPs or Elastic IPs per subnet, while ALB remains for HTTP/HTTPS content routing.

Frequently Asked Questions

Why can't an Application Load Balancer use an Elastic IP address?

ALB nodes use dynamic public IPs, and AWS does not support assigning Elastic IPs to an ALB. That makes ALB unsuitable when clients must whitelist fixed addresses.

Why is a Route 53 A record pointing to an Elastic IP not the answer?

An A record only maps a DNS name to an address; it does not attach that Elastic IP to the ELB. The web service itself still needs a static IP that clients can authorize.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

67a3f49 👍 15

A for sure. The same question was in "AWS Certified Solutions Architect Associate Practice Test 3" on Udemy. There was an explaination that NLB needs to be before ALB because only NLB can have static IP.
BillaRanga 👍 5 Answered A

B -> Application Load Balancer cannot be assigned an Elastic IP address (static IP address). C -> Its DNS after all, "Associated elastic IP" is what IP? Makes no sense D -> "If you require a persistent public IP address that can be associated to and from instances as you require, use an Elastic IP address instead." PUBLIC IP of an EC2 is not persistent, although we can give an Elastic Ip, Using EC2 in front of a Load Balancer is tooooo much. What if it gets a million request? So to scale that EC2 you use another LB and an ASG>? This makes no sense A is correct because a NLB can have an elastic IP and we can use this in our firewall as per the use case
alawada 👍 5 Answered A

A - correct (Static ip can thereafter be used for client whitelisting) Using a Network Load Balancer instead of a Classic Load Balancer has the following benefits: Support for static IP addresses for the load balancer. https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html
Sivaeas 👍 3 Answered A

Option A Please look into the below for detailed explaination https://www.scalefactory.com/blog/2021/12/13/aws-network-load-balancers-new-features/img/previously-firewall-egress.png
FlyingHawk 👍 2 Answered A

Both A and C are correct: A Uses an NLB because it supports Elastic IP addresses, which are static IPs that can be whitelisted by clients. C : Create an Alias record in Route 53 that points to the NLB. An Alias record is a Route 53-specific feature that allows you to map a domain name (e.g., webservice.example.com) directly to the NLB without needing to use the NLB's IP address in the DNS record. Clients can access the web service using the domain name (e.g., webservice.example.com), which resolves to the NLB's IP address. However, in the context of exam, I will select A since the question explicitly mentions the use of an Elastic Load Balancer (ELB), and A directly addresses this by recommending a Network Load Balancer (NLB) with an Elastic IP address.

Show 3 more comments

hajra313 👍 1

Setting up an EC2 instance with a public IP address to act as a proxy in front of the load balancer allows clients with restricted IP access to connect to the web service. The EC2 instance can handle IP address whitelisting and proxy requests to the ELB load balancer, ensuring that only authorized clients can access the service. This solution provides flexibility and control over access while leveraging the scalability and availability benefits of ELB.
Scheldon 👍 2 Answered A

AnswerA
PolarFox 👍 1 Answered C

Option C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide