Demonstrate How to Enable TLS Encryption F5N3 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which NGINX configuration snippet correctly enables HTTPS on port 443?

   • Alisten 443 https;
   • Blisten ssl 443;
   • Clisten 443 ssl;
   • Dlisten 443 tls;
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An admin has configured OCSP stapling on an NGINX server. The certificate is from a public CA. After reloading, the admin tests with openssl s_client and sees 'OCSP response: no response sent'. Which configuration is most likely missing?

   • Assl_stapling on;
   • Bssl_trusted_certificate /etc/nginx/ssl/ca-chain.crt;
   • Cssl_stapling_verify on;
   • Dresolver 8.8.8.8;
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the typical file extension for a PEM-encoded server certificate used in NGINX?

   • A.csr
   • B.crt
   • C.key
   • D.p12
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a TLS certificate, what is the role of the private key?

   • AIt is used to generate the certificate signing request (CSR) and then discarded
   • BIt is used by the server to decrypt data encrypted with the corresponding public key
   • CIt is used to encrypt the certificate itself for secure storage
   • DIt is distributed to clients to verify the server's identity
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security audit requires that the NGINX server support TLS 1.2 and TLS 1.3, but a legacy monitoring system only supports TLS 1.0. The admin cannot update the monitoring system immediately. What is the best approach to maintain security while keeping the monitoring system functional?

   • AConfigure a separate server block on a different port (e.g., 8443) that enables TLS 1.0 only for the monitoring system, and keep the main server block on 443 with TLS 1.2 and 1.3 only.
   • BEnable TLS 1.0, 1.2, and 1.3 on the main server block to support the monitoring system.
   • CUse ssl_ciphers to force the monitoring system to use TLS 1.2.
   • DDisable TLS 1.0 and require the monitoring system to be updated immediately.
   Reveal Solution Discussion Select an answer first