Test your knowledge: Nginx TLS & Security

Question 1 of 6

'NGINX terminates TLS' — what reaches the backend?

Termination is about where decryption happens.

Answer options A The TLS session itself, forwarded untouched B Decrypted plaintext HTTP on the backend leg (or re-encrypted TLS if you configure it) C A shared symmetric key the backend uses to decrypt D Nothing — termination means the connection ends at NGINX

NGINX owns the client-side handshake and certificate, then speaks plaintext (or its own new TLS) to the backend. Terminating at the edge centralizes certs, SNI, and ratings, and frees backends from crypto work.

Review this lesson

Question 2 of 6

A modern `ssl_protocols` line should contain which protocols?

TLS 1.0/1.1 and SSLv3 are dead protocols — enabling them is a finding.

Answer options A SSLv3 TLSv1 TLSv1.2 TLSv1.3 B TLSv1.2 TLSv1.3 C TLSv1 TLSv1.1 TLSv1.2 D TLSv1.3 only

TLSv1.2 and TLSv1.3 cover every current client. 1.3 removes entire attack classes (no RSA key exchange, encrypted handshake) and finishes in one round trip; keeping 1.2 is compatibility, not preference.

Review this lesson

Question 3 of 6

For mutual TLS — where clients must also present certificates — what turns verification on?

One directive flips the direction of verification.

Answer options A ssl_verify_client on; plus the trust chain via ssl_client_certificate B ssl_mutual on; C client_cert_required on; D Generating client certs from the same CA is enough

ssl_verify_client on demands a client certificate and validates it against ssl_client_certificate (your CA). The verified subject then reaches configs and logs through $ssl_client_s_dn and friends.

Review this lesson

Question 4 of 6

`ssl_session_cache shared:SSL:10m;` improves what?

Shared memory, all workers — think returning visitors.

Answer options A Certificate loading at startup B Handshake cost for returning clients — resumption state is shared across all workers C OCSP response caching D Long-lived TLS tickets for load balancing

Session resumption lets a returning client skip most of the handshake. shared: keeps the state in a common zone so any worker can resume any client's session; a built-in cache would multiply misses by worker count.

Review this lesson

Question 5 of 6

What problem does OCSP stapling ( `ssl_stapling on`) solve?

The privacy and latency problem with per-client revocation checks.

Answer options A Certificate expiry alerts B Clients no longer query the CA's OCSP endpoint themselves — NGINX fetches and attaches ('staples') the signed status to the handshake C It staples the session ticket to the connection D It pins the certificate chain in the browser cache

Without stapling every client leaks its browsing to the CA's OCSP responder and waits on it. With stapling NGINX refreshes the response on a schedule and hands it over in the handshake — private and fast.

Review this lesson

Question 6 of 6

`allow 10.0.0.0/8; deny all;` inside a location — which layer enforces this?

It is request-phase logic, not network filtering.

Answer options A The kernel firewall, configured by NGINX B NGINX's access phase (ngx_http_access_module) — evaluated per request, after rewrite, before content handlers C TLS certificate verification D The operating system's hosts.allow file

The access module runs in the access phase (after rewrite, before content) and answers with 403 when no allow line matches. Order matters — first match wins — and it complements, never replaces, a real firewall.

Review this lesson

Test your knowledge: Nginx TLS & Security