An administrator encrypts the NGINX private key with a passphrase using openssl. After updating the configuration to reference the new key, the administrator runs 'systemctl restart nginx' and the service fails to start. What is the most likely cause and the correct resolution?

NGINX cannot read the encrypted key automatically; load the passphrase using the ssl_password_file directive.

NGINX does not support encrypted private keys; decrypt the key before using it.

The certificate file is out of sync with the key; regenerate the certificate with the same passphrase.

The key file permissions are too restrictive; run chmod 644 on the key file.

What should be done immediately if an SSL private key is suspected of being compromised?

Restart NGINX to clear the key from memory.

Encrypt the key with a passphrase.

Change the file permissions to 0600.

Revoke the certificate and generate a new key pair.

What is the primary implication of encrypting an SSL private key with a passphrase?

NGINX will require the passphrase to be entered manually at every startup.

NGINX will automatically decrypt the key without any user interaction.

The certificate will need to be re-issued by the certificate authority.

The private key will become invalid and must be regenerated.

A security audit reveals that the NGINX private key file is readable by all users on the system. The key is stored in /etc/nginx/ssl/. The administrator must immediately restrict access so that only the root user and the nginx group can read it. Which command sequence accomplishes this?

chown root:nginx /etc/nginx/ssl/server.key && chmod 640 /etc/nginx/ssl/server.key

chmod 600 /etc/nginx/ssl/server.key && chown root:root /etc/nginx/ssl/server.key

chmod 700 /etc/nginx/ssl/server.key && chown nginx:root /etc/nginx/ssl/server.key

chmod 644 /etc/nginx/ssl/server.key && chown root:nginx /etc/nginx/ssl/server.key

Why might an administrator choose to encrypt a private key with a passphrase?

To protect the key even if the file is copied or stolen.

To allow multiple servers to share the same key.

To make the certificate valid for a longer period.

F5 Certified Administrator NGINX - Configuration:Demonstrate

Domain 4Objective 3

Describe How to Protect the SSL Certificate and Key F5N3 Practice Questions (Page 1)

Part of the Demonstrate how to configure certificates domain, which makes up ~22% of our current practice bank. F5 does not publish an official question count, but from its 30-minute exam (~10–20 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

Questions 1–5

1application · medium
An administrator encrypts the NGINX private key with a passphrase using openssl. After updating the configuration to reference the new key, the administrator runs 'systemctl restart nginx' and the service fails to start. What is the most likely cause and the correct resolution?
Select an answer first
2foundation · easy
What should be done immediately if an SSL private key is suspected of being compromised?
Select an answer first
3foundation · easy
What is the primary implication of encrypting an SSL private key with a passphrase?
Select an answer first
4application · easy
A security audit reveals that the NGINX private key file is readable by all users on the system. The key is stored in /etc/nginx/ssl/. The administrator must immediately restrict access so that only the root user and the nginx group can read it. Which command sequence accomplishes this?
Select an answer first
5foundation · easy
Why might an administrator choose to encrypt a private key with a passphrase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to F5N3

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “F5N3” is a trademark of its owner, used for identification only.