An organization's security policy requires that SSL private keys be encrypted at rest and that the passphrase be changed every 6 months. The NGINX server uses ssl_password_file. What is the correct procedure to change the passphrase without causing downtime?

Decrypt the key, re-encrypt it with the new passphrase, update ssl_password_file, and run 'nginx -s reload'.

Update ssl_password_file with the new passphrase and restart NGINX.

Delete the old key and create a new one with the new passphrase.

Generate a new key pair and certificate, and update the NGINX configuration.

Why is it critical to protect the private key associated with an SSL certificate?

Because the private key must be kept secret to prevent the certificate from being revoked.

Because the private key is used to encrypt all traffic between the client and server, and losing it would prevent encryption.

Because the private key is required to renew the certificate with the certificate authority.

Because anyone with the private key can impersonate the server and decrypt intercepted traffic.

A company runs NGINX in a containerized environment. The SSL private key is mounted as a volume. The security team requires that the key be protected from other containers on the same host. Which approach best meets this requirement?

Mount the key as an environment variable.

Store the key in a shared volume with permissions 644.

Use a Docker secret or Kubernetes secret to mount the key, and set file permissions to 0400 within the container.

Embed the key in the container image.

What is the purpose of setting restrictive file permissions on SSL certificate and key files?

To ensure that only authorized processes and users can read the private key.

To allow the certificate to be automatically renewed.

To prevent the certificate from being accidentally deleted.

To speed up the SSL handshake process.

F5 Certified Administrator NGINX - Configuration:Demonstrate

Domain 4Objective 3

Describe How to Protect the SSL Certificate and Key F5N3 Practice Questions (Page 4)

Part of the Demonstrate how to configure certificates domain, which makes up ~22% of our current practice bank. F5 does not publish an official question count, but from its 30-minute exam (~10–20 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

Questions 16–20

16foundation · easy
Which directory is commonly recommended for storing SSL certificates and private keys on a Linux system?
Select an answer first
17expert · hard
An organization's security policy requires that SSL private keys be encrypted at rest and that the passphrase be changed every 6 months. The NGINX server uses ssl_password_file. What is the correct procedure to change the passphrase without causing downtime?
Select an answer first
18foundation · easy
Why is it critical to protect the private key associated with an SSL certificate?
Select an answer first
19expert · hard
A company runs NGINX in a containerized environment. The SSL private key is mounted as a volume. The security team requires that the key be protected from other containers on the same host. Which approach best meets this requirement?
Select an answer first
20foundation · easy
What is the purpose of setting restrictive file permissions on SSL certificate and key files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to F5N3

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “F5N3” is a trademark of its owner, used for identification only.