Test your knowledge: Nginx Traffic Control

Question 1 of 6

`limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;` — what does the zone store?

$binary_remote_addr is a 4-byte key; the zone is shared memory.

Answer options A The last 10 MB of request bodies B Per-client (IP) request timing state — enough keys for roughly 160k addresses in 10 MB C Rate-limit configuration snippets D Responses for rate-limited clients

The shared zone tracks when each client key last sent a request, so any worker enforces the same budget. 10 MB at 4-byte IPv4 keys is roughly 160 thousand clients; overflowing keys evict the stalest.

Review this lesson

Question 2 of 6

`limit_req zone=api burst=20 nodelay;` — what changes with `nodelay`?

The default without nodelay is a drip queue — nodelay trades the wait for slot accounting.

Answer options A Excess requests are rejected immediately instead of queued B Up to 20 excess requests are served immediately; slots refill at the base rate — no artificial waiting C The rate doubles during bursts D Burst counting resets every 20 seconds

Without nodelay, burst requests wait in a leaky-bucket queue. With nodelay they execute at once and consume future capacity — clients see no artificial latency, and sustained excess still gets 503s.

Review this lesson

Question 3 of 6

`limit_conn addr 10;` limits what exactly?

It counts concurrency, not rate.

Answer options A Requests per second per client B Simultaneous connections sharing the same key value (per $binary_remote_addr in the zone) C Total connections the worker accepts D Bandwidth per client in 10 Mbit units

limit_conn caps concurrent connections per key — a different axis than limit_req's request rate. It pairs naturally with limit_rate for byte-level shaping.

Review this lesson

Question 4 of 6

What does the `geo` directive give you that `map` does not?

geo speaks networks; map speaks exact values.

Answer options A Faster variable lookups B Keying on client IP ranges (CIDR blocks, country lists), with a trustworthy $remote_addr default chain C The ability to set variables at the server level D IPv6 support — map is IPv4 only

geo maps client addresses to values via CIDR ranges — the building block for country gating. The trust chain matters: behind another proxy you must feed it the real address with the realip pair (set_real_ip_from + real_ip_header X-Forwarded-For) or geo’s source-variable form on $http_x_forwarded_for.

Review this lesson

Question 5 of 6

`split_clients "${remote_addr}${http_user_agent}" $bucket 5% .slow 95% .fast;` — what is this for?

Same client, same bucket, every time.

Answer options A Splitting request bodies across backends B Deterministic A/B or canary traffic splitting — the hash places each client in a stable percentage bucket C Geographic routing D Load-based autoscaling triggers

split_clients hashes its input into a stable 0-100% space, so each client lands in the same slice on every request — the canary-release primitive. Reordering the percentages is the classic drift bug.

Review this lesson

Question 6 of 6

A WAF-style block list built with `map` on `$request_uri` ends in what idiom?

map decides the value; a minimal guard acts on it — the cure for the if-trap.

Answer options A location /blocked { return 403; } referenced by the map's default B An if ($blocked) { return 403; } guard fed by the map, or the map value used in a deny-style phase check C deny $blocked; D limit_req with an infinite rate

The pattern: map turns patterns into 1/0, and one tiny if (or a geo/deny combination for IPs) returns 403 on the flagged value. Config-driven, readable, and immune to the content-phase if re-entry trap.

Review this lesson

Test your knowledge: Nginx Traffic Control