For a TLS client to establish a secure connection with a TLS Server, what must the client possess?

Question

Options

• Aa configured Server Profile
• Bthe appropriate CA Certificate
• Ca Domain Name Serve (DNS) resolvable address
• Da configured Client Profile

• A
  5% (1)
• B
  95% (20)

Explanation

To verify the identity of a TLS server and establish trust, the client must possess the CA (Certificate Authority) Certificate that signed the server's certificate - without it, the client cannot validate the server's identity and will reject the connection. The CA cert is the cryptographic anchor of trust in PKI-based TLS; the client uses it to verify the server's certificate chain during the TLS handshake.

Why the distractors are wrong:

• A (Server Profile): Server profiles are a firewall/load-balancer concept (e.g., in F5 or Palo Alto configs) - not something a TLS client possesses or requires natively.
• C (DNS-resolvable address): DNS resolution is a prerequisite for reaching the server, not for securing the connection. TLS can even work over raw IPs.
• D (Client Profile): A client profile is used for mutual TLS (mTLS) where the server also authenticates the client - that's an optional, additional configuration, not a baseline requirement.

Memory tip: Think "CA = Certificate Authority = trust anchor." The client needs to trust the server, and trust flows from the CA cert. No CA cert → no trust → no secure connection.

No community discussion yet for this question.