A SOC analyst investigates a series of SQL injection attempts against a public-facing web application. The WAF, running in detection-only mode, logged the requests from a single external IP and passed them through. When the analyst searches the backend web server logs in the SIEM for that external IP, nothing returns; every backend request record shows the load balancer's address as the source. What architectural characteristic most likely explains this lack of host-level attribution?

Layer 7 load balancers often terminate TLS and proxy application requests. If the device does not preserve the original client IP at the network layer or inject it into a header such as X-Forwarded-For, the backend server receives the request as coming from the load balancer. The server therefore logs the VIP or balancer address rather than the attacker, and the original attack metadata may never reach host telemetry. This makes correlation across WAF, LB, and endpoint logs unreliable. A SIEM rule that filters SQL-keyword requests could hide the payload, but it would not rewrite the source address on every request that is indexed. DNS round robin affects name resolution before the connection is made, not how an established HTTP request is distributed to a backend. A transparent bridge mode generally preserves Layer 3 source information, so it would aid rather than obscure attribution. Exam caveat: Confirm whether the load balancer terminates TLS and whether client IP headers are enabled. Operational check: Review the load balancer configuration and test a request to verify X-Forwarded-For appears in backend logs.