Describe How to Protect the SSL Certificate and Key F5N3 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An administrator encrypts the NGINX private key with a passphrase and configures ssl_password_file. During a routine restart, the service fails. The administrator checks the error log and sees 'cannot load certificate key'. What is the most likely cause?

   • AThe key file permissions are set to 600 and owner root:root.
   • BThe ssl_password_file contains the wrong passphrase or is not readable by NGINX.
   • CThe certificate file is in DER format instead of PEM.
   • DThe ssl_certificate directive points to the key file instead of the certificate.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization needs to revoke an SSL certificate that was compromised. The private key was also exposed. The administrator has already revoked the certificate with the CA. What additional action should be taken regarding the NGINX configuration and key material?

   • ADelete the key and certificate, and disable SSL on the server.
   • BKeep the existing key and certificate, and rely on the CA revocation list.
   • CReuse the same private key and request a new certificate from the CA.
   • DGenerate a new key pair, obtain a new certificate, and update the NGINX configuration to use the new files.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key characteristic of a secure storage location for SSL private keys?

   • AIt is in a world-readable directory for easy backup.
   • BIt is accessible via the web server's document root.
   • CIt is on a shared network drive for easy access.
   • DIt is outside the web server's document root and has restricted permissions.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An administrator notices that the NGINX master process runs as root, and the worker processes run as the 'nginx' user. The private key file is owned by root:root with permissions 600. When NGINX starts, it fails to load the key. What is the most likely cause?

   • AThe key file is in the wrong format.
   • BThe key file is encrypted and requires a passphrase.
   • CThe certificate file is missing or misconfigured.
   • DThe worker processes cannot read the key because they run as the 'nginx' user, not root.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary risk if an SSL private key is exposed to unauthorized users?

   • AThe certificate will be automatically revoked by the certificate authority.
   • BThe certificate will automatically expire sooner.
   • CThe server will be unable to start NGINX until the key is re-issued.
   • DThe key can be used to decrypt past and future traffic if captured.
   Reveal Solution Discussion Select an answer first