Identify TLS Connection Errors F5N4 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A client reports a TLS connection failure. The NGINX error log shows: 'SSL_do_handshake() failed (SSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure)'. Which of the following is the most likely cause of this handshake failure?

   • AThe server certificate has expired.
   • BThe server's hostname does not match the certificate.
   • CThe client and server could not agree on a common cipher suite.
   • DThe client does not trust the server's certificate authority.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A user reports that they cannot access a website hosted on NGINX. The error log shows: 'SSL_do_handshake() failed (SSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed)'. The server's certificate is valid and issued by a public CA. What is the most likely cause?

   • AThe client's trust store is outdated and does not include the root CA.
   • BThe server is not sending the intermediate certificate, so the client cannot build a complete trust chain.
   • CThe server's hostname does not match the certificate's Subject Alternative Name.
   • DThe server's certificate has expired, and the client is rejecting it.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An NGINX server's error log shows: 'SSL_do_handshake() failed (SSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert insufficient_security)'. The server is configured with ssl_protocols TLSv1.2 TLSv1.3; and ssl_ciphers HIGH:!aNULL:!MD5;. The client is a modern browser. What is the most likely cause of this alert?

   • AThe server's ssl_protocols directive is set to TLSv1.2 only, and the client requires TLSv1.3.
   • BThe server's certificate has expired, causing the client to reject the connection.
   • CThe server's cipher list does not include any cipher suite that meets the client's security requirements.
   • DThe client is using an outdated TLS version that the server does not support.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A TLS client receives an alert with the description `bad_certificate`. Which of the following is the most likely cause?

   • AThe server's certificate is corrupted or the signature is invalid.
   • BThe client's TLS version is not supported by the server.
   • CThe client and server could not agree on a cipher suite.
   • DThe server's hostname does not match the certificate.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A legacy application client fails to connect to an NGINX server. The server error log shows: 'SSL_do_handshake() failed (SSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure)'. The server is configured with ssl_protocols TLSv1.2; and ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;. The client is known to support only TLSv1.0 and TLSv1.1. What is the most direct fix?

   • AEnable TLSv1.0 and TLSv1.1 in ssl_protocols to allow the client to connect.
   • BAdd more modern cipher suites to ssl_ciphers to improve compatibility.
   • CConfigure ssl_prefer_server_ciphers on to force the server's cipher preference.
   • DReplace the server certificate with a new one that has a longer validity period.
   Reveal Solution Discussion Select an answer first