A security engineer for a company is investigating suspicious traffic on a web application in the AWS Cloud. The web application is protected by an Application Load Balancer (ALB) behind an Amazon…

Question

Options

• AEnable VPC Flow Logs in the VPC where the ALB is deployed. Examine the source field to
• BInspect the X-Forwarded-For header in the AWS WAF logs to determine the original client IP
• CModify the CloudFront distribution to disable ALB connection reuse. Examine the clientIp field in
• DConfigure CloudFront to add a custom header named Client-IP to origin requests that are sent to

• A
  5% (1)
• B
  79% (15)
• C
  5% (1)
• D
  11% (2)

Explanation

When Amazon CloudFront is used in front of an Application Load Balancer, CloudFront becomes the immediate source of incoming requests to the ALB. As a result, AWS WAF logs record the CloudFront edge location IP addresses as the client IPs, not the original viewer IP addresses. This behavior is explicitly documented in the AWS Certified Security - Specialty Study Guide and the AWS WAF and CloudFront integration documentation. To preserve the original client IP address, CloudFront automatically adds the X-Forwarded-For HTTP header, which contains the IP address of the originating client followed by any proxy addresses involved in forwarding the request. AWS WAF logs include this header, making it the authoritative source for identifying true client IP addresses when CloudFront is used.

No community discussion yet for this question.