ITPEC FE Morning April 2020 Question 45

Topic: Security

SSL/TLS is the industry-standard security technology creating encrypted connections between a web server and a web browser. This is used to maintain data privacy and to protect the information in online transactions. The steps for establishing an SSL/TLS connection are randomly listed as follows:

1.The web server sends a copy of its SSL/TLS certificate to the web browser.2.SSL/TLS encrypted communication takes place between the web browser and the web server.3.The web server sends the web browser an acknowledgment to start an SSL/TLS encrypted connection.4.The web browser checks if the SSL/TLS certificate is trustworthy or not. If it is trustworthy, then the web browser sends a message to the web server requesting to establish an encrypted connection.5.A web browser tries to connect to the web server secured with SSL/TLS.

Which of the following is the correct step sequence?

Explanation

5 → 1 → 4 → 3 → 2 — the browser connects, checks the server's certificate, and only then do both sides switch to encrypted traffic.

  • •5: the browser tries to connect to the SSL/TLS-secured server
  • •1: the server answers with a copy of its certificate
  • •4: the browser checks that the certificate is trustworthy and, if so, asks for an encrypted connection
  • •3: the server acknowledges and the encrypted session starts
  • •2: data is exchanged encrypted

Answer (d)

Why not others:

  • •(a) and (b) — both start with step 1, but the server sends its certificate only in response to a browser's connection attempt (step 5)
  • •(c) — puts encrypted communication (2) before the certificate check (4) and the server's acknowledgment (3), so data would flow over a channel that has not been authenticated or set up

Key rule: In a TLS handshake the client initiates, the server proves its identity with a certificate, the client verifies it, and only then is application data sent encrypted.

Security · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.