CAS-004 Security Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  ECDHE

  Why this is correct

  ECDHE generates an ephemeral key pair per session, then discards the private key, so compromising the long-term certificate key cannot decrypt past sessions — satisfying TLS 1.3's PFS requirement. TLS 1.3 mandates ephemeral Diffie-Hellman, and ECDHE is its recommended elliptic-curve instantiation, unlike static RSA key transport.

• ✗

  RSA key exchange

  Why it's wrong here

  RSA key exchange encrypts the premaster secret with the server's long-term certificate key, so recorded traffic is decryptable once that private key leaks, giving no forward secrecy. RSA remains valid for signing and certificate authentication; TLS 1.3 mandates ephemeral (EC)DHE for key agreement.

• ✗

  Pre-shared key (PSK)

  Why it's wrong here

  A pre-shared key is symmetric key material, not a key exchange algorithm, so it cannot deliver perfect forward secrecy: compromise of the PSK exposes all recorded sessions. PSK is tempting because TLS 1.3 does support pre_shared_key for session resumption and constrained IoT devices, but that mode lacks PFS.

• ✗

  Diffie-Hellman (DH)

  Why it's wrong here

  Finite-field Diffie-Hellman is not recommended in TLS 1.3; the standard mandates ephemeral key agreement via ECDHE, with only named FFDHE groups permitted and DHE removed. Plain DH is tempting because it does provide PFS, but TLS 1.3 requires ephemeral elliptic-curve variants, not static or generic DH.