PCI SSCPCI DSSEncryptionEASYFree question
What is end-to-end encryption in payment processing?
- A.Encryption that covers all stored cardholder data on the server (e.g., AES-256 volume encryption), with the keys held by the same administrator for the full data lifecycle
- B.Encryption that protects cardholder data from the point of capture (e.g., card reader) all the way to the processing endpoint, without decryption at intermediate points
- C.Encryption of all web sessions (e.g., TLS 1.2) from the browser to the load balancer, with decryption at the web server
- D.Encryption applied to all database columns (e.g., PAN fields) at rest, with decryption by the application for each query
Why B is correct
End-to-end encryption protects data from capture point to processing destination, keeping it encrypted throughout all intermediate stages.
Know someone studying for PCI DSS? Send them this one.