CISSP Security Architecture and Engineering Practice Question
A company is implementing a PKI to support secure web browsing. Which of the following are commonly used to enhance the security of certificate validation? (Choose TWO)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OCSP stapling
OCSP stapling allows the server to present a timestamped OCSP response, reducing load on CA. Certificate pinning associates a host with a specific certificate or public key to prevent MITM attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
OCSP stapling
Why this is correct
OCSP stapling significantly improves the efficiency and privacy of certificate revocation checks. Instead of each client directly querying the Certificate Authority's (CA) OCSP responder, the web server periodically fetches a signed OCSP response from the CA and "staples" it to its own certificate during the TLS handshake. This reduces the load on CA infrastructure, minimizes client-side latency, and enhances user privacy by preventing the CA from logging individual client queries.
- ✗
Certificate revocation lists (CRLs)
Why it's wrong here
Certificate Revocation Lists (CRLs) are a traditional method for distributing information about revoked certificates, but they present significant scalability and timeliness challenges. Clients must download and parse potentially large lists, which can introduce latency and consume bandwidth, especially for frequently updated lists. More critically, the interval between CRL publications means that a recently revoked certificate might still be considered valid until the next CRL is issued, creating a window of vulnerability.
- ✓
Certificate pinning
Why this is correct
Certificate pinning is a security mechanism where an application or browser is pre-configured to trust only a specific, expected certificate or public key for a particular domain, or a certificate issued by a specific Certificate Authority (CA). This hardcoded trust overrides the standard PKI trust chain, effectively preventing man-in-the-middle attacks even if a rogue or compromised CA issues an unauthorized certificate for the pinned domain. It provides an additional layer of defense against CA compromise.
- ✗
Self-signed root certificates
Why it's wrong here
Self-signed root certificates, while foundational for establishing a trust anchor in a private PKI, are not inherently more secure for public-facing secure web browsing. For a self-signed root to be trusted by clients, it must be manually installed and explicitly trusted in each client's trust store, which is impractical for broad public adoption. Without widespread, pre-established trust, a self-signed root does not enhance the security or usability of web browsing compared to certificates issued by publicly trusted CAs.
- ✗
Wildcard certificates
Why it's wrong here
Wildcard certificates simplify certificate management by allowing a single certificate to secure multiple subdomains under a single domain (e.g., *.example.com). While this reduces administrative overhead and cost, it does not enhance the fundamental validation mechanisms or security posture of the certificates themselves. Wildcard certificates do not introduce any new methods for verifying the revocation status or authenticity of the certificate beyond standard PKI processes, nor do they mitigate risks like CA compromise.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Certificate pinning
Certificate pinning is a security technique that associates a specific digital certificate or public key with a particular server, so that an app or system will only trust that exact certificate, rejecting any others even if they are issued by a trusted certificate authority.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.