ToppyMicroServices

RFC 9847 Quiz (EN)

IANA Registry Updates for TLS and DTLS

ENJA
0 / 0

References (URLs)

Q1: What does an N entry establish for this TLS mechanism?

Multiple Choice

A team rejects an exporter-related mechanism solely because its IANA Recommended column is N, calling that value proof that the mechanism is cryptographically flawed.

**Explanation:** A: RFC 9847 Section 3 uses D for a discouraged item. N does not encode consensus that a mechanism should not be used. B: Section 3 defines N as not evaluated by the IETF with no suitability statement and warns that it does not necessarily indicate a flaw. C: The registry value does not create a private-versus-public deployment rule. Applicability comes from the mechanism's documentation and local profile. D: Assigned entries can have N. Section 3 says any item not otherwise set to Y or D receives N. Decision rule: Use N to trigger evidence gathering from references and the deployment profile, not as shorthand for either approved or insecure.

Q2: What may a profile infer from a Y entry?

Multiple Choice

An A2A profile selects a TLS mechanism marked Y and claims the registry status proves it is appropriate for every agent operation without reading its applicability statement.

**Explanation:** A: RFC 9847 Section 3 expressly limits Y to fitness for the defined purpose and requires careful reading of applicability. B: The meaning of Y is IETF consensus and defined-purpose fitness, not the organizational origin of the initial registration request. C: Section 3 supports this bounded inference. A mechanism can be Y while having limited applicability described in its specification. D: N is the value that carries no IETF suitability statement. Y conveys more than code-point assignment, though less than universal approval. Decision rule: Registry recommendation is one input to design review; the use case must remain inside the mechanism's documented purpose and constraints.

Q3: How should this D-marked mechanism be reviewed?

Multiple Choice

An internal A2A deployment proposes a TLS mechanism marked D. The reviewer rejects it solely from the letter, while the implementer accepts it solely because the network is isolated; neither reads the linked material.

**Explanation:** A: RFC 9847 Sections 3 and 3.1 say D marks a discouraged item and direct users to references for the applicable SHOULD NOT or MUST NOT condition. B: Some referenced conditions are absolute for a stated security goal, but the D column alone does not express one universal MUST NOT for every context. C: Isolation is relevant context only if the linked rationale makes it relevant. It cannot be assumed to waive the documented weakness or constraint. D: D reflects an IETF-reviewed discouragement and has practical review meaning. It is not a neutral placeholder like an unassigned entry. Decision rule: A D value starts a conditional review: identify the documented failure mode, then apply its normative condition to the actual deployment goal.

Q4: What does approval of this TLS exporter label prove?

Multiple Choice

The label EXPORTER-A2A-session-proof passes Expert Review and IANA confirms that it is printable ASCII and not a prefix of another label. The application then treats registration as a security review of its proof protocol.

**Explanation:** A: RFC 9847 Section 7 permits deeper review but explicitly says expert approval should not be taken as endorsement of the exporter label. B: Section 7 keeps existing Y and N values and applies a separate process to changing recommendation status. Expert registration does not imply Y. C: A label namespaces an exporter use but does not supply an application identity meaning. The protocol must define its inputs and interpretation. D: Section 7 identifies the syntactic and prefix checks and limits what approval establishes. The consuming security construction remains the application's responsibility. Decision rule: Registration prevents label collisions and improves reviewability; it does not certify the semantics or security of the protocol using the exporter.

Q5: What is wrong with this automated TLS policy?

Multiple Choice

A deployment tool makes every Y item mandatory and automatically allows every N item. It blocks D items without exposing their Reference or Comment to reviewers.

**Explanation:** A: RFC 9847 Section 3 does not make Y universally mandatory or N affirmatively safe, and Section 3.1 requires context for D. B: The N mapping is unsafe, but Y still needs applicability review and is not a requirement to activate every mechanism. C: Sections 3 and 3.1 define these three distinct meanings. A useful tool can surface them, but cannot collapse them into require, allow, and block without context. D: The column summarizes consensus status. RFC 9847 repeatedly directs readers to mechanism documentation, references, comments, and applicability. Decision rule: Registry metadata can prioritize review, but final policy must combine status, referenced constraints, protocol needs, and local risk acceptance.

Q6: Which review conclusion fits this session-bound A2A profile?

Multiple Choice

The profile follows RFC 9325 for TLS versions and ciphers, uses an exporter label registered with N, derives a session proof at the gateway, and authorizes at a backend. The label's specification does not define forwarding across TLS termination.

**Explanation:** A: RFC 9847 Sections 3 and 7 bound what N and registration mean. RFC 9325 covers TLS deployment, while application and gateway trust rules must define the rest of the composition. B: N carries no IETF suitability statement and is not proof of a flaw. Its specification and the deployment's use are necessary evidence. C: A TLS configuration BCP does not define application proof semantics or make a backend endpoint part of the client-gateway TLS session. D: Section 7 says expert approval is not endorsement. It cannot authorize forwarding an exporter-derived assertion across a different channel. Decision rule: No single registry letter or TLS checklist supplies the composed guarantee; trace the exporter to its channel instance and protect every trust-boundary transition.