You try to start a service and systemd flatly refuses: Failed to start nginx.service: Unit nginx.service is masked. Masking is the strongest form of disabling in systemd — the unit is symlinked to /dev/null so it can't be started by anything, manually or as a dependency.
Confirm it's masked
systemctl status nginx # Loaded: masked (Reason: Unit ... is masked.) systemctl list-unit-files nginx.service # STATE = masked
Someone usually masks a unit to stop it coming back during an incident (or a package script does it), then forgets to reverse it. It's deliberate, so understand why before you undo it.
Unmask and start
systemctl unmask nginx # removes the /dev/null symlink systemctl start nginx systemctl is-enabled nginx # enable if it should also start at boot
Note the ladder: mask is stronger than disable. Unmasking only makes starting possible again — you still start (and maybe enable) it. For services that start but then die, see troubleshooting a systemd service that won’t start.
Practise it
A masked unit is one of the simulator's Linux incidents. Work it in Linux troubleshooting practice.