Nginx powers a large share of the world’s websites as a web server, reverse proxy and load balancer. These Nginx interview questions cover the architecture, configuration, proxying, performance and security topics that come up in DevOps and Linux interviews.
Basics
1. What is Nginx?
Nginx (pronounced “engine-x”) is an open-source web server, reverse proxy, load balancer and HTTP cache. Igor Sysoev created it, and it was first released publicly in 2004. F5 acquired the company behind it in 2019 and offers a commercial version, NGINX Plus.
2. Why is Nginx fast?
It uses an event-driven, asynchronous architecture. A small number of worker processes each handle thousands of connections without creating a thread per connection. As a result, it uses little memory under heavy load.
3. Describe the process model.
A master process reads the configuration and manages worker processes, which handle requests. Usually you set worker_processes auto; to match CPU cores.
4. Nginx vs Apache?
Apache traditionally uses a process- or thread-based model and supports per-directory .htaccess files. Nginx is event-driven, excels at static files and proxying, and keeps configuration central. Many setups put Nginx in front of Apache or application servers.
Configuration
5. How is the configuration organised?
The main file is /etc/nginx/nginx.conf. It contains contexts such as events, http, server and location. Site files often live in /etc/nginx/conf.d/ or sites-available with links in sites-enabled.
6. What is a server block?
A server block defines a virtual host: the ports it listens on, its server_name and how it handles requests.
7. How does Nginx choose a location block?
- Exact matches (
location = /path) win first. - Next, Nginx finds the longest prefix match; if it uses
^~, regex checks are skipped. - Then regular expressions (
~and~*) are tested in order, and the first match wins. - Otherwise, the longest prefix match is used.
8. How do you test and reload configuration safely?
Run nginx -t to check syntax, then systemctl reload nginx to apply changes without dropping connections.
Proxy and load balancing
9. Configure a basic reverse proxy.
location /api/ {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}10. Which load-balancing methods exist?
Round robin (default), least_conn, ip_hash and hash on a custom key. You define back ends in an upstream block, and Nginx marks failing servers as unavailable based on max_fails and fail_timeout.
11. How does caching work?
proxy_cache_path defines a cache zone on disk, and proxy_cache enables it in a location. Cache keys, validity times and bypass rules control behaviour.
Security and performance
12. How do you secure Nginx?
- Use HTTPS with TLS 1.2 and 1.3 only. See SSL certificates for Nginx.
- Hide the version with
server_tokens off;. - Add security headers, such as HSTS, Content-Security-Policy and X-Content-Type-Options.
- Limit request rates with
limit_reqto slow brute-force attacks. - Restrict admin paths by IP or authentication.
- Keep Nginx and the OS patched.
13. How do you enable compression?
Use gzip on; with suitable gzip_types, or Brotli through a module, to reduce response sizes.
14. What does a 502 Bad Gateway error mean?
Nginx could not get a valid response from the upstream server. Check whether the back end is running, the port is correct, and SELinux or firewalls are not blocking the connection. Then read /var/log/nginx/error.log.
15. 502 vs 504?
502 means the upstream sent an invalid response or refused the connection. 504 means it did not respond in time, so check timeouts such as proxy_read_timeout.
To practise, follow our guides to installing Nginx and building it from source.
Keep preparing
Practise each answer out loud, and run the commands in a lab rather than memorising them. Interviewers often ask follow-up questions, so make sure you understand why each answer is true.
Sources
Preparing for an interview? Browse more questions in our interview preparation hub. For businesses, we also offer security services such as VAPT, server hardening and ISO 27001 readiness.
