CAS-004 Security Engineering Practice Question
A security engineer is configuring a new web server to support TLS 1.3. The server must provide forward secrecy and support clients that may not have updated certificates frequently. Which of the following is a feature of TLS 1.3 that addresses these requirements?
⚠ Common exam trap
Candidates may think that removing RSA key exchange directly helps with certificate update frequency, but it does not; the key feature for forward secrecy is mandatory ephemeral key exchange.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mandatory use of ephemeral Diffie-Hellman key exchange
TLS 1.3 mandates forward secrecy by requiring ephemeral Diffie-Hellman (ECDHE) key exchange for all sessions. This ensures that if the server's long-term private key is compromised, past session keys remain secure. While TLS 1.3 does remove cipher suites that use RSA key exchange (which lack forward secrecy), this removal does not directly address the requirement to support clients with infrequently updated certificates. The question asks for a feature that satisfies both forward secrecy and support for clients with infrequently updated certificates; only mandatory use of ephemeral Diffie-Hellman key exchange directly provides forward secrecy, which is the key requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mandatory use of ephemeral Diffie-Hellman key exchange
Why this is correct
Correct. TLS 1.3 mandates ephemeral Diffie-Hellman key exchange (ECDHE) for forward secrecy, ensuring session keys remain secure even if the server's long-term key is compromised. This also helps clients with infrequent certificate updates because forward secrecy relies on ephemeral keys rather than static certificate usage.
- ✗
Support for certificate pinning
Why it's wrong here
Incorrect. Certificate pinning is not a feature of TLS 1.3; it is a security mechanism separate from the protocol version. It does not directly address forward secrecy or certificate update frequency.
- ✗
Support for 0-RTT handshake
Why it's wrong here
Incorrect. 0-RTT (zero round trip time) handshake in TLS 1.3 allows faster resumption but does not provide forward secrecy. In fact, 0-RTT data is not forward secret, so it does not satisfy the forward secrecy requirement.
- ✗
Removal of cipher suites that use RSA key exchange
Why it's wrong here
Incorrect. TLS 1.3 does remove cipher suites that use RSA key exchange, which improves security by eliminating non-forward-secret options. However, this removal does not directly address the requirement to support clients with infrequently updated certificates. The question specifically asks for a feature that addresses both forward secrecy and certificate update frequency; removal of RSA key exchange is a security improvement but does not help with certificate updates.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.