1. Home
2. All questions
3. Question 42

CISSP study material · question 42 of 500

A telemetry platform holds long-lived TLS 1.3 connections that stream millions of small records per session under AES-GCM, and some clients also send early data on resumption. An engineer asks what an endpoint owes as the record count climbs, and how early data is handled. Which response is correct?

• Network security
• Security engineering

1. Keep the same keys until the resumption ticket expires; the record sequence number wraps, and the ceiling covers early data only.
2. Rekey or close before roughly 2^24.5 records under one key set; early data is rekeyed mid-flight exactly like ordinary records.
3. Rekey or close before roughly 2^24.5 records under one key set; early data cannot be rekeyed, so the sender stays under the ceiling.
4. Rekey only when the peer sends a key update request; the ceiling applies to the whole connection rather than one key set.

Challenge yourself on this topic → Study as cards