In mTLS, what additional validation occurs that is not in standard TLS?

• A. The client validates the server certificate.
• B. The server validates the client certificate.
• C. The session is encrypted with a single certificate.
• D. The server uses password authentication.

Answer: (B)

Mutual TLS adds client authentication to the TLS handshake. In standard TLS, the client verifies the server’s identity by checking the server’s certificate. In mTLS, the server also verifies the client’s identity by requiring and validating a client certificate presented during the handshake. This two-way verification establishes trust in both directions, ensuring that both parties are who they claim to be.

So why this option fits best? The new validation in mTLS is the server validating the client certificate, which is what enables two-way authentication. The other statements aren’t describing this extra step: the client validating the server’s certificate is already part of standard TLS, nothing new; encryption in TLS isn’t based on “a single certificate” in the way suggested, since session keys are derived during the handshake; and passwords aren’t part of how TLS authenticates in either mode.