ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Diffie-Hellman Ephemeral (DHE) is a classic key-agreement protocol. During a DHE exchange, each peer generates a private random value and sends the corresponding public value to the other side. Both sides then derive the identical symmetric session key from the combination of their own private value and the other party's public value, ensuring that neither side alone determines the key.

RSA key transport encrypts a session key generated by one party with the recipient's public key-only one side selects the key, so it is a key-exchange, not a key-agreement, method. A static pre-shared key offers no dynamic generation or bilateral contribution. Encrypting a session key with the certification authority's private key is not a standard or secure method for negotiating session keys and would violate PKI trust principles. Therefore, configuring DHE satisfies the requirement that both peers jointly establish the session key.