Which setting determines whether SSL data is encrypted on the wire?

• A. SSL certificate type
• B. TCP profile
• C. SSL cipher suite configuration
• D. TLS version

Answer: (C)

Encryption on the wire is determined by the cipher suite configuration. A cipher suite defines the algorithms used for the TLS session, including the key exchange method, the bulk encryption algorithm (the on-wire encryption), and the MAC. During the TLS handshake, the client and server agree on a cipher suite; the chosen bulk cipher then governs how data is encrypted as it travels over the network. The SSL certificate type is about authentication and identity, not the actual encryption of data on the wire. A TCP profile affects transport behavior but not the encryption itself. TLS version sets what protocol features and ciphers may be available, but the actual on-wire encryption is decided by the cipher suite chosen during negotiation.