Which symptom would most strongly suggest SSL encryption is not configured on a server?

• A. Packets captured show plaintext data
• B. The connection completes TLS handshake with a strong cipher
• C. The server returns 500 Internal Server Error
• D. The data transfer is always encrypted

Answer: (A)

When SSL/TLS is in use, the data payload is encrypted after the handshake, so what you see on the network is unreadable application data even though the connection is secure. If you capture packets and the contents are readable in cleartext, that means the traffic isn’t being encrypted by SSL/TLS for that server, so SSL encryption is not configured there. This is the most definitive signal that encryption isn’t applied to the connection.

Seeing a TLS handshake with a strong cipher would indicate encryption is configured, because the handshake and certificate exchange establish the secure channel. A 500 Internal Server Error is just an HTTP error and doesn’t reveal anything about whether SSL is enabled. If the data transfer is always encrypted, that points to encryption being in place (though it could be due to other factors like an upstream terminator), not to a lack of SSL configuration on the server.