Which observation indicates the start of a TLS handshake?

• A. A client sends DNS queries
• B. A TLS Certificate message appears
• C. ClientHello and ServerHello messages occur
• D. HTTP GET is sent

Answer: (C)

The handshake starts when the client begins TLS negotiation by sending a ClientHello, and you’ll typically see the server respond with a ServerHello as the next step. This exchange signals that the client and server are negotiating the TLS parameters (protocol version, cipher suites, session data, etc.). The presence of both messages shows the handshake is underway and parameters are being chosen.

Context helps: ClientHello carries what the client supports (TLS version, cipher suites, extensions), and ServerHello confirms the chosen version and cipher suite, then the server may follow with its certificate and further steps. DNS queries are unrelated to TLS handshakes, and an HTTP GET occurs only after the TLS handshake has completed, as application data over the secure channel. A Certificate message is part of the handshake, but it appears after the ServerHello as part of authenticating the server, not at the very start.