You have a business-to-business web application running in a VPC consisting of an Elastic Load Balancer (ELB), web servers, application servers and a database. Your web application should only accept traffic from predefined customer IP addresses. Which two options meet this security requirement? Choose 2 answers

Answer options:

A.Configure ELB security group to allow traffic from your customer IPs
B.Configure web server security group to allow traffic from ELB
C.Configure ELB security groups to allow traffic from your customers’ IPs and deny all outbound traffic
D.Configure a VPC NACL to allow web traffic from your customers’ IPs and deny all outbound traffic

Answer - A and B
The Web servers security group can help ensure that the requests come from the customer’s IP via Rules in the security group.
The X-Forwarded-For request header helps you identify the IP address of a client when you use an HTTP or HTTPS load balancer. Because load balancers intercept traffic between clients and servers, your server access logs contain only the IP address of the load balancer. To see the IP address of the client, use the X-Forwarded-For request header.
For more information on X-Forwarded-For request , please refer to the link:
http://docs.aws.amazon.com/es_es/elasticloadbalancing/latest/classic/x-forwarded-headers.html