Heartbleed affects which component?

• A. The HTTP protocol.
• B. The OpenSSL TLS implementation.
• C. The SSH protocol.
• D. The DNS protocol.

Answer: (B)

This item tests recognizing that Heartbleed is a flaw in the OpenSSL TLS implementation, not in the TLS protocol itself or in other protocols. The vulnerability arose from a missing bounds check in OpenSSL’s heartbeat feature, which allowed an attacker to read memory from the server or client process by sending a crafted heartbeat request. That memory could include sensitive data such as private keys, session cookies, usernames, or passwords. The issue is specific to OpenSSL’s TLS code, so it’s not about the HTTP, SSH, or DNS protocols themselves. Patching OpenSSL to fix the heartbeat handling closes the hole, which is why the OpenSSL TLS implementation is the correct reference for what Heartbleed affected.