ITPEC FE Morning October 2021 Question 44
To provide a guarantee to its online customers that all credit card information is protected when transferred between their PC and the web service over public networks, which of the following technologies should be used?
Explanation
TLS — it encrypts the connection between the customer's browser and the web server, which is what HTTPS is.
TLS sits between HTTP and TCP. In the handshake the server proves its identity with a certificate and both sides agree on session keys; after that everything sent, including a card number typed into a form, crosses the public network encrypted and integrity-checked. The customer needs nothing but a browser.
Answer (c)
Why not others:
- •(a) S/MIME — signs and encrypts email messages, not web traffic.
- •(b) SSH — secures remote login and file transfer for administrators; browsers do not use it to reach a web service.
- •(d) VPN — a tunnel between networks, or between an employee and the corporate network; a web shop cannot make every customer set one up, and the browser already speaks TLS.
Key rule: Match the protocol to the traffic: web pages use TLS (HTTPS), email uses S/MIME, remote shells use SSH, and network-to-network links use a VPN.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.