Home · A-Level Computer Science 9618 · Security · SSL and TLS · Practice
A2 · Practice questions · SSL and TLS

Shake hands, then talk.

Six original Cambridge-style questions on SSL and TLS in client-server communication, with mark-scheme solutions.

Original questions All questions on this page are original work, written in the Cambridge AS & A Level style. They are not from past papers. They test the same concepts and skills the syllabus rewards.
Keep these straight

Certificate, key, session.

01
Recall
[3 marks]

State three purposes of Transport Layer Security (TLS).

  • To encrypt data sent between client and server so it cannot be understood if intercepted. ✓
  • To authenticate the server (and optionally the client) using a digital certificate. ✓
  • To ensure data integrity: data altered in transit is detected. ✓
02
Explain
[5 marks]

A user types the address of their bank’s website, which uses HTTPS. Describe how SSL/TLS sets up a secure connection between the browser and the web server.

  • The browser requests a secure connection and sends the TLS versions / cipher suites it supports. ✓
  • The server replies with its chosen cipher suite and its digital certificate (containing its public key). ✓
  • The browser checks the certificate is valid / issued by a trusted CA / in date / for this domain. ✓
  • The browser generates session key material, encrypts it with the server’s public key and sends it. ✓
  • The server decrypts it with its private key; both now use the shared symmetric session key to encrypt all data. ✓
03
Explain
[2 marks]

Explain why SSL/TLS uses a symmetric session key to encrypt the data rather than continuing to use asymmetric encryption.

  • Symmetric encryption is much faster / needs less processing than asymmetric encryption. ✓
  • A session involves a large amount of data; asymmetric encryption is used only to exchange the key securely. ✓
04
Apply
[4 marks]

Identify two situations where the use of SSL/TLS is appropriate. For each, explain why.

  • Online banking / payments: account and card details must not be readable if intercepted. ✓
  • Logging in to a website: the password (and session cookie) must be protected from packet sniffing. ✓
  • Accept also: email between client and server, online forms with personal data, VoIP / instant messaging, VPNs, cloud file transfer. ✓
  • One mark for each situation, one for each matching reason. ✓
05
Analysis
[3 marks]

A student says: "If a website uses HTTPS, it must be safe to enter my card details." Discuss this claim.

  • HTTPS means the data is encrypted between the browser and that server, so it cannot be read in transit. ✓
  • The certificate only proves the site controls that domain name; criminals can obtain certificates for their own look-alike domains. ✓
  • The user should still check the domain name is correct and the business is genuine; HTTPS does not make the site itself trustworthy. ✓
06
Recall
[2 marks]

State the difference between SSL and TLS, and explain where SSL/TLS operates in the TCP/IP protocol stack.

  • TLS is the successor to SSL; SSL is older and its versions are now insecure / deprecated. ✓
  • It operates between the application layer (e.g. HTTP) and the transport layer (TCP). ✓

Mark this once you have attempted all six and checked your working. It records a Practiced badge on the topic and adds a one-time bonus. Revealing the solutions alone does not count.