SSL/early TLS is considered strong cryptography and may be used as a security control.

SSL/early TLS is considered strong cryptography and may be used as a security control.

• A. TRUE
• B. FALSE
• C. Not specified
• D. Not applicable

Answer: (B)

SSL and early TLS are not considered strong cryptography because these older protocols have well-known weaknesses and limited protections. Modern security controls rely on TLS 1.2 or higher with up-to-date cipher suites that provide forward secrecy and authenticated encryption (for example, AES-GCM). PCI DSS requires strong cryptography and explicitly disallows relying on SSL or early TLS to protect cardholder data. So the statement is not true.

SSL and early TLS are not considered strong cryptography because these older protocols have well-known weaknesses and limited protections. Modern security controls rely on TLS 1.2 or higher with up-to-date cipher suites that provide forward secrecy and authenticated encryption (for example, AES-GCM). PCI DSS requires strong cryptography and explicitly disallows relying on SSL or early TLS to protect cardholder data. So the statement is not true.