What statement describes what is visible after decrypting TLS traffic?

• A. Only headers are visible
• B. Full HTTP data and headers
• C. DNS queries are visible
• D. TLS certificates are shown

Answer: (B)

Decrypting TLS removes the encryption that protects the application data, so the actual content carried inside the TLS records becomes readable. In the case of HTTPS, this means you can see the entire HTTP conversation: the request line with the method, URL, and HTTP version, all HTTP headers, and the message body. You get the full picture of what the client sent and what the server responded with, including status codes, cookies, and any form data. The TLS handshake elements, like the server certificate, are seen during the handshake, but the decrypted stream you’re inspecting here focuses on the HTTP data flowing inside the session. DNS queries aren’t part of the decrypted HTTP payload unless you’re using DNS-over-TLS; they’re typically separate. So the best description is that you gain access to the full HTTP data and headers after successful TLS decryption.