Describe How to Protect the SSL Certificate and Key F5N3 Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   An administrator wants to protect an NGINX private key with a passphrase. The key is currently unencrypted. The administrator runs 'openssl rsa -aes256 -in server.key -out server_encrypted.key' and updates the NGINX configuration to use the new file. What additional step is required for NGINX to start successfully?

   • AChange the key file permissions to 777 so NGINX can read it.
   • BRestart NGINX with the 'nginx -g' flag to bypass the passphrase prompt.
   • CSet the ssl_password_file directive to a file containing the passphrase.
   • DConvert the key to PEM format before using it.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company stores its NGINX SSL certificate and private key in /etc/nginx/ssl/. The security team requires that only the root user and the nginx worker process can read the private key. The nginx master process runs as root, and workers run as the 'nginx' user. Which command should you run to meet this requirement?

   • Achmod 600 /etc/nginx/ssl/server.key && chown root:root /etc/nginx/ssl/server.key
   • Bchmod 660 /etc/nginx/ssl/server.key && chown nginx:root /etc/nginx/ssl/server.key
   • Cchmod 640 /etc/nginx/ssl/server.key && chown root:nginx /etc/nginx/ssl/server.key
   • Dchmod 644 /etc/nginx/ssl/server.key && chown root:nginx /etc/nginx/ssl/server.key
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An administrator is configuring NGINX with an encrypted private key. The key is encrypted with a passphrase, and the administrator wants to avoid an interactive prompt at startup. The server is managed by a configuration management tool that runs NGINX as a service. What is the best way to provide the passphrase?

   • AStore the passphrase in the NGINX configuration file as a variable.
   • BUse the 'nginx -g' flag to pass the passphrase at startup.
   • CSet the passphrase as an environment variable and reference it in the config.
   • DCreate a file with the passphrase, set permissions to 600, and reference it with ssl_password_file.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company runs NGINX on a server where multiple applications share the same filesystem. The security team wants to ensure that SSL private keys are stored in a location that is not accessible to other applications. Which location and permission set is most appropriate?

   • A/etc/ssl/private/ with mode 640 and owner root:ssl-cert, nginx user added to ssl-cert group
   • B/var/lib/nginx/ with mode 644 and owner nginx:nginx
   • C/etc/nginx/ssl/ with mode 700 and owner root:root
   • D/home/nginx/ with mode 700 and owner nginx:nginx
   Reveal Solution Discussion Select an answer first