mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A large organization needs to deploy a Public Key…
A large organization needs to deploy a Public Key Infrastructure (PKI) for thousands of devices and users. A key requirement is the ability to revoke certificates in real time when a device is lost or compromised. Which solution is most appropriate?
⚠ Common exam trap
Test-takers frequently confuse periodic CRL distribution (which is batch-oriented and slow) with real-time revocation, or assume a single CA with a large CRL is sufficient, overlooking the scalability and latency issues that make OCSP the correct choice for immediate status checks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Online Certificate Status Protocol (OCSP) responders.
OCSP provides real-time certificate status checking by querying an OCSP responder directly, eliminating the delays inherent in CRL distribution. This meets the requirement for immediate revocation verification when a device is lost or compromised, as the responder can return a 'revoked' status instantly without waiting for a CRL refresh cycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy multiple hierarchical CAs and distribute CRLs periodically.
Why it's wrong here
While deploying multiple hierarchical CAs can enhance scalability and trust management within a PKI, relying solely on periodic distribution of Certificate Revocation Lists (CRLs) introduces a significant security vulnerability. There is an inherent delay between when a certificate is revoked and when the updated CRL is downloaded and processed by all relying parties. During this window, a compromised certificate remains valid and usable, allowing potential attackers to exploit it.
- ✗
Rely on certificate expiration only and do not implement revocation.
Why it's wrong here
Omitting any form of certificate revocation mechanism and relying only on certificate expiration is a critical security flaw for any robust Public Key Infrastructure. If a private key is compromised, or a certificate is issued erroneously, that certificate would remain trusted and fully functional until its natural expiration date, which could be months or even years away. This extended period allows an attacker to impersonate the legitimate entity or decrypt sensitive data, severely undermining the integrity and confidentiality of communications.
- ✗
Use a single Certificate Authority (CA) with a large Certificate Revocation List (CRL).
Why it's wrong here
Using a single Certificate Authority (CA) that manages an increasingly large Certificate Revocation List (CRL) introduces significant operational and performance challenges for a large organization. As the number of revoked certificates grows, the CRL file size expands, leading to longer download times for clients and increased processing overhead during validation. This can cause substantial delays in certificate status checks, consume excessive network bandwidth, and potentially lead to timeouts or failures in critical applications that rely on timely certificate validation.
- ✓
Implement Online Certificate Status Protocol (OCSP) responders.
Why this is correct
Implementing Online Certificate Status Protocol (OCSP) responders provides a highly efficient and near real-time method for verifying the revocation status of digital certificates. Instead of requiring clients to download and parse potentially large and outdated CRLs, OCSP allows a client to send a specific query for a particular certificate's status to a responder, receiving an immediate 'good,' 'revoked,' or 'unknown' response. This significantly reduces latency and bandwidth usage, ensuring that relying parties can quickly ascertain the current validity of a certificate, which is crucial for dynamic and high-volume transaction environments.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.