Demonstrate How to Enable TLS Encryption F5N3 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security scan reports that the NGINX server supports weak cipher suites. The admin wants to disable all ciphers that use RSA key exchange and only allow ECDHE-based key exchange. Which ssl_ciphers value achieves this?

   • Assl_ciphers 'DEFAULT:!RSA';
   • Bssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:RSA-AES128-GCM-SHA256';
   • Cssl_ciphers 'HIGH:!aNULL:!MD5';
   • Dssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which NGINX directive enables TLS session caching?

   • Assl_session_cache
   • Bssl_session_tickets
   • Cssl_session_timeout
   • Dssl_cache
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has two domains, www.example.com and api.example.com, both served by the same NGINX server. They have separate certificates for each domain. The admin wants to serve both domains over HTTPS using the correct certificate for each. Which configuration approach is required?

   • AUse a single server block with the ssl_certificate directive specified twice.
   • BUse the ssl_certificate directive in the http block to apply to all server blocks.
   • CUse a single server block with both server_name directives and a single certificate that covers both domains.
   • DUse two separate server blocks, each with its own listen 443 ssl directive, server_name, and ssl_certificate directives.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which command-line tool can be used to test an HTTPS endpoint and view the TLS certificate details?

   • Adig
   • Btraceroute
   • Copenssl s_client
   • Dping
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of a certificate signing request (CSR) in the process of obtaining a server certificate?

   • AIt is the final certificate that the server uses to encrypt traffic
   • BIt is a backup of the certificate used for recovery purposes
   • CIt is a request containing the public key and identifying information sent to a certificate authority to obtain a signed certificate
   • DIt is a file that contains the server's private key and is sent to the CA
   Reveal Solution Discussion Select an answer first