Study. uk . com
  1. Home
  2. All questions
  3. Question 395

CompTIA Security+ study material · question 395 of 611

An API adopts TLS 1.3 zero-round-trip resumption for speed. Which request must not be sent as early data?

  1. A cached asset request
  2. A read of a public resource
  3. A payment submission
  4. A health check
Show the answer

Answer: C. A payment submission

Early data is replayable, so anything that changes state must not travel in it.

Source: RFC 8446 (IETF) — RFC 8446 § 2.3 0-RTT Data and Appendix E.5

Challenge yourself on this topic → Study as cards