A telecom company uses AWS with a Direct Connect between on-premises and AWS. The application runs on EC2 instances in multiple AZs behind an internal ALB. Clients on the on-premises network connect to the application using HTTPS; TLS terminates at the ALB. The ALB uses multiple target groups and path-based routing. The company will deploy an on-premises firewall appliance that only allows traffic to known IP addresses. Which solution will allow on-premises traffic to reach the application and satisfy the firewall allow-list requirement?

The correct solution uses an NLB in front of the ALB to provide static IP addresses. ALBs are designed to scale and their IP addresses can change dynamically, making them unsuitable for a firewall allow-list that requires static IPs. An NLB, however, can be configured with static IP addresses, which can then be added to the on-premises firewall. By registering the existing ALB as a target for the NLB, the application's existing routing logic (path-based routing, multiple target groups) is preserved. Clients are updated to connect to the NLB's static IPs. Incorrect options: Configuring the ALB directly with static IPs is not a native feature of ALBs. ALBs are designed for dynamic scaling and their IP addresses can change. Deleting the ALB and moving target groups to the NLB would remove the path-based routing and HTTPS termination capabilities of the ALB, which are required by the application. NLBs operate at Layer 4 and do not support these Layer 7 features. A Gateway Load Balancer (GWLB) is designed for deploying, scaling, and managing virtual appliances, not for providing static IPs for an application load balancer.