PCI SSCPCI DSSEncryptionEASYFree question
Why does PCI DSS require HTTPS for web-based payment pages?
- A.HTTPS uses a signed server certificate to hash the PAN before it leaves the form, protecting stored card data on the web server and the database from tampering
- B.HTTPS uses IPsec to tunnel traffic between data centers, protecting the internal backbone and the payment switch from sniffing
- C.HTTPS uses a firewall rule to block port 80, protecting the web server and the database from unauthorized inbound connections
- D.HTTPS uses TLS to encrypt the connection between the user's browser and the web server, protecting cardholder data entered on payment pages from interception
Why D is correct
HTTPS encrypts the connection between browser and server using TLS, preventing interception of cardholder data entered on payment pages.
Know someone studying for PCI DSS? Send them this one.