What must be completed if SSL or early TLS is used?

• A. Disable TLS entirely
• B. Complete the required security steps for SSL/early TLS
• C. Use only unencrypted connections
• D. Ignore TLS configurations

Answer: (B)

The essential idea here is that if you are using SSL or an older version of TLS, you must implement and document the specific security steps defined for SSL/early TLS to address the vulnerabilities and keep the environment compliant. In practice, that means hardening the TLS setup and following PCI guidance—things like upgrading to TLS 1.2 or higher, disabling SSL 2.0/3.0, and TLS 1.0/1.1; turning off weak cipher suites; ensuring proper certificate management; enabling strong cryptography and forward secrecy; and providing the required evidence from scans and configuration reviews. Without completing these steps, relying on SSL/early TLS would leave you noncompliant. That’s why this option is correct: you must complete the required security steps for SSL/early TLS. The other options would either undermine security (using unencrypted connections), disable essential protections (disabling TLS entirely), or ignore configurations, which is not acceptable for PCI DSS.