F5N3 NGINX Configuration: Demonstrate Practice Questions
Prepare for F5N3 with more than an answer.
- 1
An administrator configures the following access control list for an internal dashboard:
location /admin {
deny 192.168.1.50;
allow 192.168.1.0/24;
deny all;
}A request arrives from IP address 192.168.1.50. How does NGINX handle this request?
Show answer details
Correct answer: A
NGINX evaluates 'allow' and 'deny' directives sequentially in the order they are written. As soon as a match is found, NGINX stops processing the list. Since 'deny 192.168.1.50' is first, it matches immediately and access is denied.
- 2
A developer wants to secure a REST API endpoint so that any client can read data (GET, HEAD methods), but only clients from the internal corporate network (10.0.0.0/8) can modify data (POST, PUT, DELETE methods).
Which configuration block achieves this?
Show answer details
Correct answer: A
The 'limit_except' directive limits access to all HTTP methods EXCEPT the ones listed. In this case, GET and HEAD are unrestricted. For all other methods (POST, PUT, DELETE, etc.), the access rules within the block apply, allowing only the 10.0.0.0/8 network.
- 3
Case Study: Centralized Authentication
Background:
A financial enterprise uses NGINX Open Source as an API Gateway in front of several internal microservices. They have a central Identity Provider (IdP) service listening internally athttp://auth.internal:8080/verify.Current Situation:
The security team dictates that all requests to/secure-api/must be authenticated by the IdP before NGINX forwards the request to the backend microservice. The IdP returns a200 OKstatus if the user token (passed in headers) is valid, and a401 Unauthorizedor403 Forbiddenif invalid.Requirement:
You must configure NGINX to delegate authentication for/secure-api/to the IdP without redirecting the client. If the IdP returns 200, NGINX should proxy the request to the backend. If it returns 401/403, NGINX should deny access and return that error to the client.Which configuration best satisfies these requirements?
Show answer details
Correct answer: A
This is the optimal implementation of subrequest authentication. The 'auth_request' directive triggers an internal subrequest to '/auth-verify'. The internal location block proxies this to the IdP. Crucially, 'proxy_pass_request_body off;' and clearing 'Content-Length' ensures only headers are sent to the auth server, saving bandwidth while validating the token.
sequenceDiagram participant Client participant NGINX participant IdP as Auth Server participant Backend Client->>NGINX: GET /secure-api/ (with Token) NGINX->>IdP: Subrequest GET /verify (Headers only) alt Token Valid IdP-->>NGINX: 200 OK NGINX->>Backend: Forward original GET /secure-api/ Backend-->>NGINX: Response Data NGINX-->>Client: 200 OK + Response Data else Token Invalid IdP-->>NGINX: 401 Unauthorized NGINX-->>Client: 401 Unauthorized end - 4
When implementing HTTP Basic Authentication in NGINX using the
auth_basicdirective, which tool is conventionally used to generate the required password file referenced byauth_basic_user_file?Show answer details
Correct answer: A
The 'htpasswd' utility (historically part of Apache HTTP Server tools, but widely used with NGINX) is the standard tool used to create and update the flat-files storing usernames and hashed passwords for basic authentication.
- 5
A systems engineer is configuring NGINX to protect a backend API from being overwhelmed by sudden traffic spikes. The requirement is to limit requests to 10 per second per IP address, but allow bursts of up to 20 requests to be processed immediately without adding artificial delay. Which configuration block achieves this?
Show answer details
Correct answer: A
The correct configuration uses 'limit_req_zone' to define the rate (10r/s) and 'limit_req' with both 'burst=20' to allow queuing up to 20 requests, and 'nodelay' to ensure those burst requests are processed immediately rather than being delayed to match the 10r/s rate.
- 6
A video streaming platform wants to allow users to download the first 50 Megabytes of a video file at full speed, but then restrict the download speed to 500 Kilobytes per second for the remainder of the file to save bandwidth. Which combination of NGINX directives should be used?
Show answer details
Correct answer: A
The 'limit_rate_after' directive specifies the amount of data (50m) that is transferred at maximum speed before the bandwidth throttling specified by 'limit_rate' (500k) takes effect.
