During a TLS 1.2 session review, a SOC analyst notes that after the initial handshake, the client and server exchange large volumes of encrypted application data efficiently using a shared session key. The analyst is asked which cryptographic approach protects the bulk data transfer once the session is established, and why it was chosen over the method used during the handshake. What is the correct answer?