Which mechanism ensures that a client connects to a legitimate server by validating the server's certificate during a secure session?

• A. TLS certificate validation.
• B. Password policy.
• C. IP address filtering.
• D. Two-factor authentication.

Answer: (A)

Validating the server's certificate during a secure session is what lets the client trust the server’s true identity. In TLS, the server presents a certificate that asserts who it is, issued by a trusted certificate authority. The client then performs certificate validation: it follows the certificate chain to a trusted root, verifies the certificate’s signature, checks that it hasn’t expired, confirms the hostname in the certificate matches the server’s address, and may check revocation status (via OCSP or CRLs). If all these checks pass, the client establishes an encrypted channel with the legitimate server, preventing imposters from intercepting or tampering with the connection.

The other options don’t perform this server-identity verification during a secure session. A password policy governs user credentials, not server identity. IP address filtering controls which network endpoints can be reached but doesn’t validate the server’s certificate during the TLS handshake. Two-factor authentication strengthens user authentication, but it doesn’t verify the server’s identity in the TLS process.