ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Under PCI DSS 4.0, SSL 3.0 and early TLS versions such as 1.0 must not be used, and cipher suites that rely on outdated algorithms like 3DES or RC4 are considered weak. TLS 1.2 (or higher) with a suite that uses ephemeral elliptic-curve Diffie-Hellman (ECDHE) achieves perfect forward secrecy, and AES-GCM supplies confidentiality and built-in integrity protection; SHA-256 in the suite name refers to the hash used in TLS's pseudorandom function and handshake, not to the MAC on application data. The selected suite also supports optional client-certificate authentication, satisfying the mutual-authentication requirement without extra client software because modern browsers already support TLS 1.2. By contrast, SSL 3.0 with 3DES and TLS 1.0 with RC4 are explicitly disallowed, and an IPsec tunnel with a static pre-shared key is not standard for browser-based payments and does not guarantee forward secrecy. Therefore, preferring TLS 1.2 with the ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 cipher suite is the most appropriate choice.