C - Correct Here's what you can look for to identify a resumed TLS connection in ssldump: 1. Missing ClientHello and ServerHello messages: In a resumed session, these messages are omitted as the client can reuse the existing session information. 2. Session ID presence: Look for the "Session ID" field in the handshake messages. If present, it indicates that the client is attempting to resume a previous session. 3. Cipher Suite agreement: In resumed sessions, the client and server directly agree on the cipher suite without negotiation, unlike the multiple options offered in a full handshake. 4. Short and fast handshake: Resumed sessions have significantly shorter handshakes as they do not require the full key exchange process. 5. Missing server certificate: Since the server already presented its certificate during the initial handshake, it won't be resent in a resumed session.