How can you inspect HTTP content after decryption of TLS traffic?

• A. Use Follow TLS Stream or inspect the HTTP data within the decrypted TLS stream
• B. Use Follow TCP Stream
• C. Save as PCAP and reopen
• D. Open the certificate to view HTTP data

Answer: (B)

Once TLS has been decrypted, the HTTP messages are carried over the same TCP connection, so you can reassemble and inspect them by following that TCP stream. The TCP stream view shows the entire conversation in order, including HTTP requests and responses and their headers and bodies, once the encryption layer has been removed. This makes it a straightforward way to see the actual HTTP content that was exchanged. Saving the capture or opening the certificate won’t directly reveal the HTTP payload, and while you could use a TLS-specific view if you have the decrypt keys, following the TCP stream is a practical, direct way to inspect the decrypted HTTP data.