A company is decommissioning a server that hosted NGINX with SSL. The security policy requires that the private key be securely destroyed. Which method is most appropriate?

Move the key file to a different directory and delete it.

Delete the key file using the 'rm' command.

Change the key file permissions to 000.

Overwrite the key file with random data using a tool like shred, then delete the file.

What is the purpose of key rotation in SSL/TLS management?

To periodically replace the private key and certificate to limit the impact of a potential compromise.

To reduce the size of the certificate file.

To change the certificate authority.

A company requires that SSL private keys be backed up securely, but the backup team uses a shared storage system that is accessible to multiple departments. The security policy states that private keys must not be exposed to unauthorized personnel. Which backup strategy best meets the requirement?

Exclude private keys from backups and rely on the original server only.

Back up the private key in a compressed archive with a simple password.

Copy the private key to the shared storage with file permissions set to 600.

Encrypt the private key with a passphrase before backing it up, and store the passphrase separately in a secure vault.

A company's security team requires that SSL private keys be encrypted with a passphrase and that the passphrase be stored in a hardware security module (HSM). The NGINX server must use the key without exposing the passphrase in a file. What is the best approach?

Store the passphrase in ssl_password_file and restrict permissions to 600.

Decrypt the key and store it without a passphrase.

Use an environment variable to pass the passphrase to NGINX.

Use an HSM integration or a PKCS#11 engine supported by NGINX to access the key.

F5 Certified Administrator NGINX - Configuration:Demonstrate

Domain 4Objective 3

Describe How to Protect the SSL Certificate and Key F5N3 Practice Questions (Page 3)

Part of the Demonstrate how to configure certificates domain, which makes up ~22% of our current practice bank. F5 does not publish an official question count, but from its 30-minute exam (~10–20 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

Questions 11–15

11expert · hard
A company is decommissioning a server that hosted NGINX with SSL. The security policy requires that the private key be securely destroyed. Which method is most appropriate?
Select an answer first
12foundation · easy
What is the purpose of key rotation in SSL/TLS management?
Select an answer first
13expert · hard
A company requires that SSL private keys be backed up securely, but the backup team uses a shared storage system that is accessible to multiple departments. The security policy states that private keys must not be exposed to unauthorized personnel. Which backup strategy best meets the requirement?
Select an answer first
14foundation · easy
Which file permissions are recommended for an SSL private key file on a Linux system?
Select an answer first
15expert · hard
A company's security team requires that SSL private keys be encrypted with a passphrase and that the passphrase be stored in a hardware security module (HSM). The NGINX server must use the key without exposing the passphrase in a file. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to F5N3

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “F5N3” is a trademark of its owner, used for identification only.