How Do You Add Static IPs and AWS WAF to a Multi-Region HTTP App?

SAA-C03 By islever Editorial Last updated

Design highly available and/or fault-tolerant architectures. Design secure workloads and applications.

Short answer

B Front the Regional ALBs with AWS WAF and register them as endpoints of AWS Global Accelerator, which supplies the required static IP addresses.

Question

A company has users all around the world accessing its HTTP-based application deployed on Amazon EC2 instances in multiple AWS Regions. The company wants to improve the availability and performance of the application. The company also wants to protect the application against common web exploits that may affect availability, compromise security, or consume excessive resources. Static IP addresses are required. What should a solutions architect recommend to accomplish this?
  1. Put the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an accelerator using AWS Global Accelerator and register the NLBs as endpoints.
  2. Put the EC2 instances behind Application Load Balancers (ALBs) in each Region. Deploy AWS WAF on the ALBs. Create an accelerator using AWS Global Accelerator and register the ALBs as endpoints. Correct Answer
  3. Put the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the NLBs.
  4. Put the EC2 instances behind Application Load Balancers (ALBs) in each Region. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the ALBs. Deploy AWS WAF on the CloudFront distribution.

Key Takeaways

The question tests whether you can combine a layer 7 load balancer, AWS WAF, and a fixed entry point — the trap is that AWS WAF cannot be attached to a Network Load Balancer and CloudFront never provides static IP addresses.

A global HTTP application running on EC2 in multiple Regions must simultaneously gain performance, high availability, AWS WAF protection against web exploits, and static IP addresses. This page establishes that only ALBs with AWS WAF registered as endpoints of AWS Global Accelerator (B) satisfy every requirement at once.

Common mistake: Picking CloudFront with Route 53 latency-based routing (C or D) because it looks like the natural global-performance answer, while overlooking that CloudFront uses large sets of dynamically changing edge IPs; the other frequent error is choosing NLB (A), which is layer 4 and not a supported AWS WAF target.

Expert Analysis

Why the Answer Is Correct

Option B satisfies all four stated requirements in one architecture. Application Load Balancers are layer 7 and correctly handle an HTTP-based application, and AWS WAF can be attached directly to an ALB to block common web exploits such as SQL injection and cross-site scripting that could affect availability or consume resources. AWS Global Accelerator is the only service here that provides static IP addresses — each accelerator gets two fixed anycast IPs (plus optional bring-your-own IPs) that never change. Registering the Regional ALBs as accelerator endpoints gives health-checked failover and routes user traffic over the AWS global network, improving availability and performance for users around the world.

Why the Other Options Are Wrong

Option A is invalid because AWS WAF is not supported on Network Load Balancers; an NLB is a layer 4 device that cannot inspect HTTP requests, so "Deploy AWS WAF on the NLBs" is technically impossible even though NLB is itself a valid Global Accelerator endpoint. Option C has the same fatal flaw — WAF on an NLB — and it also puts CloudFront in place of Global Accelerator, which removes the static IP addresses. Option D fixes the WAF placement (CloudFront does support AWS WAF) but still fails the hard constraint: CloudFront distributions serve traffic from dynamically assigned edge IP ranges and cannot be given fixed static IP addresses, and the Route 53 latency-based origin does not change that.

Community Comment Notes

As ogerber explains, the HTTP-based nature of the application points to ALB and the static IP requirement points to Global Accelerator, quoting that "By default, Global Accelerator provides you with static IP addresses that you associate with your accelerator." zinabu makes the same layer 4 argument, stating "NLB doesn't support Http based traffic it is just used for TCP/UDP based traffic," while osmk notes NLB "does not support AWS WAF directly." Two commenters (alawada and stephensimudemy) reinforce the disqualifier for the CloudFront options: "CloudFront uses multiple sets of dynamically changing IP addresses while Global Accelerator will provide you with a set of static IP addresses." f07ed8f adds that "CloudFront doesn't support assigning a static IP address to distributions." Only mohammadthainat argued for D, and although his observation that WAF cannot sit on an NLB is correct, his own answer still loses the static IP requirement; Naveena_Devanga's pick of C fails for the same reason.

Sources: AWS Global Accelerator static IP addresses; AWS WAF supported resources.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a scenario demands static IP addresses, immediately eliminate every CloudFront option, and when it demands protection from web exploits, eliminate any option that places AWS WAF on an NLB. AWS Global Accelerator plus ALB plus WAF is the only combination that survives both filters on SAA-C03.

Frequently Asked Questions

Why can't AWS WAF be attached to a Network Load Balancer in options A and C?

AWS WAF is only supported on Application Load Balancers, CloudFront, API Gateway, and AppSync. An NLB works at layer 4, so it has no HTTP request context for WAF to inspect.

Why doesn't CloudFront meet the static IP address requirement in option D?

CloudFront serves content from large sets of dynamically changing edge IP addresses, so no fixed address can be published. Global Accelerator instead provides two static anycast IPs as a permanent entry point.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. ogerber 👍 12 Answered B
    HTTP based application so ALB is required. because static IP addresses are required, we should use global accelerator: "By default, Global Accelerator provides you with static IP addresses that you associate with your accelerator."
  2. zinabu 👍 4 Answered B
    Http based app=ALB static IP= AWS global accelerator for those who choice ''A'' NLB doesn't support Http based traffic it is just used for TCP/UDP based traffic.
  3. mohammadthainat 👍 3 Answered D
    Something wrong in the question, here is why: Static IP addresses are required --> NLB protect against common web exploits --> WAF (But you can't use WAF directly with NLB) HTTP-based application --> Cloudfront (using CloudFront with NLB is not recommended) EC2s in multiple AWS Regions --> Route 53 latency-based
  4. jaswantn 👍 3
    Static IP addresses are required, so option B....global accelerator with ALB
  5. f07ed8f 👍 3 Answered B
    CloudFront doesn't support assigning a static IP address to distributions
Show 6 more comments
  1. alawada 👍 2 Answered B
    CloudFront uses multiple sets of dynamically changing IP addresses while Global Accelerator will provide you a set of static IP addresses as a fixed entry point to your applications
  2. osmk 👍 2 Answered B
    Network Load Balancer (NLB): NLB operates at layer 4 and does not support AWS WAF directly https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html
  3. TruthWS 👍 1
    Option A Static IP --> NLB against common web exploits --> WAF performance --> Global Accelerator is best choice in this situation.
  4. Naveena_Devanga 👍 1
    Correct Answer is C. Static IP addresses are required specific to the requirement.
  5. Andy_09 👍 5
    Option D
  6. Dhokal 👍 3
    B is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide