hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A security analyst is evaluating the impact of…
A security analyst is evaluating the impact of upgrading web servers from TLS 1.2 to TLS 1.3. Which advantage does TLS 1.3 offer in terms of handshake efficiency?
⚠ Common exam trap
Test-takers frequently confuse 'fewer round trips' with 'eliminating asymmetric encryption,' but TLS 1.3 still relies on asymmetric key exchange (e.g., ECDHE) for forward secrecy, just in a more streamlined handshake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fewer round trips during handshake
TLS 1.3 reduces the handshake from two round trips (2-RTT) in TLS 1.2 to one round trip (1-RTT) for a full handshake, and offers 0-RTT for resumed sessions. This is achieved by combining the ClientHello and ServerHello with key exchange parameters, eliminating the separate round trip for the ServerHello and Certificate exchange. The result is lower latency and faster connection establishment, which is critical for performance-sensitive applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It supports the same cipher suites as TLS 1.2
Why it's wrong here
TLS 1.3 significantly tightens security by deprecating many older, insecure cryptographic primitives and cipher suites found in TLS 1.2, such as RSA key exchange, CBC-mode ciphers, and SHA-1 hashes. It exclusively mandates Authenticated Encryption with Associated Data (AEAD) modes like AES-GCM and ChaCha20-Poly1305, which provide both confidentiality and integrity in a single operation. Therefore, it does not support the same broad set of cipher suites as its predecessor.
- ✓
Fewer round trips during handshake
Why this is correct
TLS 1.3 drastically improves performance by reducing the handshake process to just one Round Trip Time (1-RTT) for initial connections, compared to the two RTTs typically required by TLS 1.2. This efficiency is achieved because the client can proactively send its key share in its initial "Client Hello" message. The server can then immediately respond with its key share and the encrypted handshake messages, allowing application data transmission to begin sooner.
- ✗
More round trips during handshake
Why it's wrong here
Stating that TLS 1.3 requires more round trips during the handshake is incorrect, as a core design goal of TLS 1.3 was to enhance efficiency and reduce latency. Unlike TLS 1.2, which typically necessitates two full round trips to establish a secure connection, TLS 1.3 streamlines this to a single RTT for a full handshake. This reduction significantly improves web performance and responsiveness, especially over high-latency networks.
- ✗
It eliminates the need for asymmetric encryption
Why it's wrong here
TLS 1.3 does not eliminate the need for asymmetric encryption; rather, it continues to rely on it for crucial security functions. Asymmetric cryptography, specifically Elliptic Curve Diffie-Hellman (ECDHE) or Diffie-Hellman (DHE), is still fundamental for securely exchanging ephemeral session keys between the client and server. Furthermore, asymmetric encryption is used for server authentication, where the server presents its digital certificate signed by a Certificate Authority, proving its identity.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
TLS
Transport Layer Security (TLS) is a cryptographic protocol that encrypts data sent over the internet to keep it private and ensure it hasn’t been tampered with.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.