Which defense protects against MITM by validating server certificates?

• A. Firewalls
• B. Hashing passwords
• C. Password policies
• D. TLS with certificate validation

Answer: (D)

Validating server certificates during TLS prevents a man-in-the-middle from posing as the legitimate server. When a TLS session starts, the server presents a certificate. The client then traces that certificate back to a trusted authority, confirms the domain name matches, checks that it hasn’t expired or been revoked, and verifies the certificate chain. If everything checks out, the client and server establish an encrypted channel using the server’s key, so an attacker cannot decrypt, alter, or impersonate the server without a trusted certificate and private key.

Firewalls control where traffic can flow but don’t verify the server’s identity during a TLS handshake. Hashing passwords protects stored credentials and does not secure the transport channel. Password policies address how credentials are created and managed, not how data is protected in transit.