ISC2 CISSP Practice Question

The correct answer is ensuring clients and middleware strictly validate the full certificate chain and check the certificate's revocation status. The primary defense TLS provides against man-in-the-middle (MITM) attacks is the authentication of the server, which is accomplished by the client validating the server's digital certificate. This process involves walking the certificate chain up to a trusted root CA and checking that the certificate has not been revoked via OCSP or CRLs. Without this strict validation, an attacker could present a fraudulent or compromised certificate and successfully impersonate the server.

Selecting the most performant elliptic curve algorithm is a configuration choice related to performance and efficiency, not the fundamental trust mechanism that prevents MITM attacks.

Configuring the session resumption timeout is related to balancing performance and security for returning users but does not address the initial authentication that prevents MITM attacks.

Archiving private keys in an HSM is a critical control for protecting the server's identity, but it is a data-at-rest protection for the key material. The prevention of an active MITM attack relies on the client's actions to validate the server's identity during the handshake, not how the server stores its key afterward.