hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A network architect is designing a network to…
A network architect is designing a network to comply with PCI DSS requirements that cardholder data must be encrypted during transmission over open networks. Which protocol should be used for encrypting traffic between a point-of-sale (POS) terminal and the payment gateway?
⚠ Common exam trap
A common mix-up: candidates confuse TLS 1.0 with TLS 1.2, assuming all TLS versions are equally secure, but PCI DSS explicitly requires TLS 1.2 or higher, and TLS 1.0 is considered weak and non-compliant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TLS 1.2
TLS 1.2 is the correct choice because it is a widely accepted, secure protocol for encrypting data in transit, and it meets PCI DSS requirements for strong cryptography. PCI DSS explicitly prohibits the use of SSL and early TLS versions (1.0) due to known vulnerabilities, and TLS 1.2 provides robust cipher suites and forward secrecy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TLS 1.0
Why it's wrong here
TLS 1.0 is deprecated due to known cryptographic vulnerabilities, such as BEAST and POODLE attacks, which compromise its confidentiality. PCI DSS Requirement 2.2.3 and 4.1 explicitly prohibit the use of insecure protocols, including TLS 1.0, for the transmission of cardholder data. Organizations must migrate to more secure versions to maintain compliance and protect sensitive information.
- ✓
TLS 1.2
Why this is correct
TLS 1.2 is currently considered a strong cryptographic protocol, supporting robust algorithms like AES-GCM and SHA-256 for encryption and hashing, respectively. It effectively mitigates vulnerabilities present in older versions, making it compliant with PCI DSS Requirement 4.1 for securing cardholder data in transit. Its widespread adoption ensures interoperability and strong security for payment transactions.
- ✗
SSH
Why it's wrong here
Secure Shell (SSH) is a cryptographic network protocol primarily designed for secure remote command-line access, file transfers (SFTP), and tunneling services. While SSH provides strong encryption and authentication, it is not engineered for the high-volume, transactional nature of point-of-sale (POS) data transmission or web-based payment processing. Its operational model is fundamentally different from the application-layer security required for typical payment card transactions.
- ✗
SSL 3.0
Why it's wrong here
SSL 3.0 is an obsolete and highly insecure protocol, famously vulnerable to the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack, which allows attackers to decrypt sensitive data. Due to these critical weaknesses, PCI DSS Requirement 2.2.3 and 4.1 strictly prohibit its use for any system component involved in the storage, processing, or transmission of cardholder data. Continued use would result in immediate non-compliance.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
PCI DSS
The Payment Card Industry Data Security Standard is a set of security requirements designed to protect credit card data during storage, processing, and transmission.
Key term
TLS
Transport Layer Security (TLS) is a cryptographic protocol that encrypts data sent over the internet to keep it private and ensure it hasn’t been tampered with.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.