Which statement about FIPS approval of SSL cipher suites is supported by the material?

• A. Many SSL cipher suites are not FIPS approved and thus not allowed for use in FIPS 140-2 conforming SSL VPNs
• B. All SSL cipher suites are FIPS approved
• C. FIPS approval is irrelevant for SSL VPNs
• D. SSL cipher suites do not impact FIPS compliance

Answer: (A)

Understanding FIPS compliance for SSL VPNs centers on which cryptographic algorithms and TLS/SSL cipher suites are allowed under a FIPS-validated setup. In FIPS 140-2 environments, the cryptographic components used must be validated, so only cipher suites that rely on FIPS-validated algorithms are permitted. This means many commonly used SSL cipher suites, which rely on non-FIPS-validated algorithms, cannot be used in a FIPS-conforming SSL VPN. That’s why the statement that many SSL cipher suites are not FIPS approved and thus not allowed for use in FIPS 140-2 conforming SSL VPNs is supported.

It's not true that all SSL cipher suites are FIPS approved, and FIPS approval is relevant for SSL VPNs because the security posture depends on using validated cryptography. Also, the chosen cipher suite directly impacts FIPS compliance, so saying cipher suites don’t affect FIPS compliance isn’t accurate.