SOA-C02 · Question #621
A company has hybrid connectivity by using an AWS Site-to-Site VPN connection between an on- premises network and a VPC. The company creates a new public Network Load Balancer (NLB) and a TCP target…
The correct answer is B. The public IP addresses of the network interfaces that the NLB uses. When traffic is sent to a public Network Load Balancer, the targets that are registered by IP address and are outside of the VPC receive traffic with the source IP address rewritten. In this case, the onpremises application will see the public IP addresses of the NLB's network…
Question
A company has hybrid connectivity by using an AWS Site-to-Site VPN connection between an on- premises network and a VPC. The company creates a new public Network Load Balancer (NLB) and a TCP target group that uses the default settings. The target group specifies the IP address of an on- premises application. The on-premises application filters incoming traffic by comparing the IP addresses of the incoming traffic to an allowlist of known IP addresses. A SysOps administrator needs to provide a list of client IP addresses that must be allowed to send traffic to the on-premises application. Which IP addresses should the SysOps administrator provide to meet these requirements?
Options
- AThe private IP addresses of the network interfaces that the NLB uses
- BThe public IP addresses of the network interfaces that the NLB uses
- CThe private IP addresses of the clients that connect to the NLB
- DThe public IP addresses of the clients that connect to the NLB
How the community answered
(51 responses)- A6% (3)
- B78% (40)
- C14% (7)
- D2% (1)
Explanation
When traffic is sent to a public Network Load Balancer, the targets that are registered by IP address and are outside of the VPC receive traffic with the source IP address rewritten. In this case, the onpremises application will see the public IP addresses of the NLB's network interfaces as the source of the traffic. Therefore, to allow the traffic, the SysOps administrator should provide an allowlist that includes the public IP addresses of the NLB's network interfaces.
Topics
Community Discussion
No community discussion yet for this question.