Describe How to Run NGINX as a Specific User Type F5N1 Practice Questions (Page 4)

Questions 16–18

1. 16expert · hard

   A company policy requires that no process run as root. The NGINX master process must run as the 'nginx' user. The server needs to serve traffic on port 443. The administrator has already set 'user nginx;' in nginx.conf. What additional configuration is required to allow the master process to bind to port 443?

   • ARun the master process as root and use 'user nginx;' for workers.
   • BUse iptables to redirect port 443 to a high port like 8443.
   • CUse 'setcap cap_net_bind_service=+ep /usr/sbin/nginx' to grant the binary the capability to bind to privileged ports.
   • DChange the user directive to 'user root;' so the master can bind to port 443.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An administrator sets 'user webapp;' in nginx.conf. After reloading, the administrator checks the running processes and sees that worker processes are running as 'webapp'. However, the administrator notices that the error log /var/log/nginx/error.log is still owned by root:root and cannot be written to by the workers. What is the most likely reason the log file was not created by the webapp user?

   • AThe user directive must be placed in the http context to affect log file ownership.
   • BThe webapp user does not have a home directory, so NGINX cannot create logs.
   • CThe log file was created by the master process before it dropped privileges to the webapp user.
   • DThe log file must be manually created by the administrator before starting NGINX.
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   An administrator configures NGINX with 'user nginx;' and sets the client_body_temp_path to /var/lib/nginx/body. The directory /var/lib/nginx/body is owned by root:nginx with permissions 770. After a reload, NGINX fails to write temporary files to this directory. What is the most likely cause and the best fix?

   • AThe directory permissions are too restrictive; change them to 777.
   • BThe client_body_temp_path directive must be in the http context, not the main context.
   • CThe 'nginx' user is not a member of the 'nginx' group; add the user to the group.
   • DThe master process must be restarted, not reloaded, for the temp path to take effect.
   Reveal Solution Discussion Select an answer first