TLS should be enabled for CHD transmissions whenever possible.

• A. TLS is enabled for CHD transmissions whenever possible.
• B. TLS is optional for CHD transmissions.
• C. TLS is never used for CHD transmissions.
• D. TLS is only used for internal network traffic.

Answer: (A)

The key idea is protecting cardholder data as it travels between systems. PCI DSS requires encryption of CHD in transit when it moves over open, public networks, and TLS is the standard way to provide that protection. By enabling TLS for CHD transmissions whenever possible, you ensure the data remains confidential, cannot be tampered with, and can be authenticated as coming from a legitimate source. This minimizes the risk of interception or manipulation while the data is in flight.

TLS being mandatory here contrasts with the idea that encryption is optional, never used, or only for internal traffic. The goal is to use TLS to safeguard CHD transmissions in as many scenarios as possible; if a system truly cannot use TLS, you would rely on compensating controls, but the default and best practice is to enable TLS whenever feasible.