Enable/Disable Ciphers and TLS Version F5N3 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which NGINX directive is used to specify the allowed cipher suites for an HTTPS server?

   • Assl_protocols
   • Bssl_ciphers
   • Cssl_session_cache
   • Dssl_certificate
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In the ssl_ciphers directive, what does the '!' character before a cipher name (e.g., !aNULL) indicate?

   • AThe cipher is added to the allowed list.
   • BThe cipher is removed from the allowed list.
   • CThe cipher is prioritized higher.
   • DThe cipher is only used for TLSv1.3.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An NGINX administrator needs to configure the server to prefer the most secure cipher suites while still allowing fallback to less secure ones for older clients. The administrator wants to explicitly list the ciphers in order of preference. Which directive and value accomplishes this?

   • Assl_prefer_server_ciphers on;
   • Bssl_ciphers HIGH:!aNULL:!MD5;
   • Cssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:!aNULL;
   • Dssl_ciphers DEFAULT;
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An NGINX administrator needs to configure a server to support only TLS 1.3, which is the most secure version. Which ssl_protocols value should be used?

   • Assl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
   • Bssl_protocols TLSv1.2 TLSv1.3;
   • Cssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
   • Dssl_protocols TLSv1.3;
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An NGINX administrator is troubleshooting a client that cannot connect. The client supports TLS 1.2 and the cipher ECDHE-RSA-AES128-GCM-SHA256. The server is configured with ssl_protocols TLSv1.2 TLSv1.3; and ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384;. What is the most likely cause of the connection failure?

   • AThe client does not support TLS 1.2
   • BThe server's cipher list does not include any cipher that the client supports
   • CThe server does not support TLS 1.2
   • DThe client's cipher is too weak
   Reveal Solution Discussion Select an answer first