hardMultiple SelectObjective-mapped
CISSP Practice Question: Which THREE are essential elements of a Transport…
Which THREE are essential elements of a Transport Layer Security (TLS) handshake? (Choose three.)
⚠ Common exam trap
Many exam-takers confuse optional features like session resumption (session tickets) or client authentication as mandatory handshake elements, when in fact the three essential components are cipher suite negotiation, certificate exchange, and key generation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key generation
Key generation is essential because during a TLS handshake, the client and server derive session keys using the pre-master secret exchanged via asymmetric encryption (e.g., RSA or Diffie-Hellman). These keys are then used for symmetric encryption of the session, ensuring confidentiality and integrity. Without key generation, no secure communication channel can be established.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Key generation
Why this is correct
Key generation is a fundamental element because it establishes the symmetric encryption keys used to protect the confidentiality and integrity of all subsequent application data exchanged during the secure session. During the TLS/SSL handshake, cryptographic primitives like Diffie-Hellman or RSA are employed to securely derive these shared secret keys. This process ensures that only the communicating parties can encrypt and decrypt the session's traffic, making secure communication possible.
- ✓
Cipher suite negotiation
Why this is correct
Cipher suite negotiation is essential as it allows the client and server to agree upon a mutually supported set of cryptographic algorithms for the secure communication. This agreement specifies the key exchange method, the symmetric encryption algorithm (e.g., AES), the hashing function for message authentication (e.g., SHA256), and potentially the digital signature algorithm. Without a successful negotiation, the parties cannot establish a common cryptographic framework to secure the data.
- ✓
Certificate exchange
Why this is correct
Certificate exchange is a critical component, primarily enabling the client to authenticate the server's identity and establish trust. The server presents its digital certificate, which contains its public key and is signed by a trusted Certificate Authority (CA). The client validates this certificate to ensure it is communicating with the legitimate server and not an imposter, thereby preventing man-in-the-middle attacks.
- ✗
User authentication
Why it's wrong here
User authentication, often referring to client-side authentication, is not an essential element for establishing the fundamental transport layer security itself. While TLS/SSL can support client certificates for mutual authentication, the core function of securing the communication channel (confidentiality, integrity, server authentication) can proceed without explicitly authenticating the end-user or client application. This process is typically handled at the application layer, separate from the initial secure channel setup.
- ✗
Session ticket exchange
Why it's wrong here
Session ticket exchange, used for TLS session resumption, is not an essential element for the initial establishment of a secure transport layer connection. Session tickets allow a client to resume a previous session without a full handshake, improving performance and reducing latency for subsequent connections. However, the secure channel can be fully established and function correctly without ever utilizing or exchanging session tickets, making them an optional optimization rather than a core requirement.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Symmetric encryption
Symmetric encryption is a cryptographic method where the same secret key is used to both encrypt and decrypt data, ensuring confidentiality between two parties.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.