Entities using SSL and early TLS for POS POI terminal connections must work toward upgrading to a strong cryptographic protocol as soon as possible.

• A. Optional
• B. Undetermined
• C. True
• D. False

Answer: (C)

The main concept being tested is that PCI standards require protecting cardholder data in transit with strong cryptography and disallow insecure protocols like SSL and early TLS for POS/POI connections. SSL and early TLS have known weaknesses that can be exploited to intercept or alter data, so PCI guidance pushes to migrate to TLS 1.2 or higher with strong ciphers. Because of this, the statement that entities must work toward upgrading to a strong cryptographic protocol as soon as possible is true. It reflects a required move away from insecure protocols to protect payment data, not something optional or undetermined. Upgrading aligns with PCI DSS goals and current best practices for securing payment environments.