A hotel analyst compares a TLS session that encrypts HTTP with a DNS session whose payload is another protocol. Which session is tunneling rather than encryption?
Select an answer to reveal the explanation.
Short Explanation
Encryption is a locked box on the same road; a tunnel is a second shipment hidden inside the first. You are looking at a DNS session whose payload is another protocol, and that is tunneling rather than TLS hiding HTTP. The trap is picking the TLS session, a NAT rewrite, or a load-balancer cookie.
Full Explanation
Tunneling places one protocol inside another. Encryption protects the payload of the session that is already in front of the analyst. The hotel comparison gives a TLS session that encrypts HTTP and a DNS session whose payload is some other protocol. The tunneling case is the DNS session, because the foreign payload is being carried inside DNS rather than being looked up as a name. The matching session is "The DNS session whose payload is another protocol, carried inside DNS as a tunnel rather than as name lookup". The TLS session is the encryption case in this comparison. Its job is to protect HTTP, so "The TLS session, whose job is encrypting HTTP on that same hotel connection" is not the tunnel. Address translation rewrites the guest address. It does not wrap a second protocol, so "A network address translation that rewrites the hotel guest address on the way out" fails. A load-balancer cookie keeps a browser on one server. It is session affinity, not a covert protocol wrapper, so "A load-balancer cookie that pins the guest browser to one web server for the stay" fails. Exam caveat: TLS can carry more than HTTP in other designs, but this question contrasts encrypted HTTP with a DNS payload that is another protocol. Operational check: inspect the DNS payload for content that is not a normal name lookup, and keep the TLS session in the encryption column of the same comparison.