Find the right cloud certification, then start practicing

Question Analysis

Core Concept: This question tests how to provide fixed, allowlistable public IP addresses for a load-balanced service on AWS. The key distinction is that most AWS load balancers (especially ALB) do not provide static IPs; instead, you typically use DNS. When customers require IP-based firewall allowlisting, you need an architecture that can present stable IPs. Why the Answer is Correct: A Network Load Balancer (NLB) can be associated with Elastic IP addresses (EIPs) for each subnet/AZ where the NLB has a node. This gives you stable, fixed public IPs that clients can allowlist, while still providing managed load balancing and high availability. NLB operates at Layer 4 (TCP/UDP/TLS), which is sufficient for many web services and is commonly used specifically for the “static IP for load balancer” requirement. Key AWS Features: - NLB + Elastic IPs: You can allocate EIPs and assign them to the NLB’s subnet mappings, resulting in one static IP per AZ. - High availability: Deploy the NLB across multiple AZs; clients allowlist all EIPs. - Preserves client IP: NLB can pass the source IP to targets (useful for logging and security controls). - Works with TLS: NLB supports TLS listeners if needed, or you can terminate TLS on targets. Common Misconceptions: Many assume an Application Load Balancer can use EIPs; it cannot. ALB is reached via DNS name and its underlying IPs can change. Another misconception is to “just use Route 53 to point to an EIP,” but an EIP is a single endpoint and does not provide load balancing or multi-AZ resilience by itself. Exam Tips: When you see “clients require fixed IPs/allowlisting” + “load balancer,” think NLB with EIPs (or AWS Global Accelerator in other scenarios, but it’s not an option here). Also remember: ALB/NLB are typically addressed by DNS, but only NLB supports static IPs via EIPs. Ensure you account for one EIP per enabled AZ and instruct clients to allowlist all of them.