Courseiva
Security Architecture and EngineeringmediumMultiple ChoiceObjective-mapped

CISSP Security Architecture and Engineering Practice Question

A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

OCSP Stapling

OCSP stapling allows a TLS server to present a signed OCSP response from the CA, reducing load on the CA and providing timely revocation status.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Certificate Transparency Logs

    Why it's wrong here

    Certificate Transparency (CT) logs are public, append-only records designed to audit and monitor the issuance of SSL/TLS certificates by Certificate Authorities (CAs). Their primary purpose is to detect misissued or maliciously issued certificates by providing a transparent, verifiable record for domain owners and the public. However, CT logs do not provide real-time revocation status; they only record when a certificate was issued, not if it has subsequently been revoked.

  • OCSP Stapling

    Why this is correct

    OCSP Stapling is an efficient method for web servers to provide clients with the revocation status of their own SSL/TLS certificates during the TLS handshake. The server periodically queries the Certificate Authority's (CA) Online Certificate Status Protocol (OCSP) responder for its certificate's status, caches the signed response, and "staples" it to the certificate sent to the client. This significantly improves privacy and performance by eliminating the need for each client to directly query the OCSP responder, reducing latency and server load.

  • Certificate Pinning

    Why it's wrong here

    Certificate Pinning is a security mechanism where a client application or web browser is configured to expect a specific public key or certificate for a particular domain. This hardcoded trust relationship helps prevent man-in-the-middle attacks, even if a trusted Certificate Authority (CA) is compromised and issues a fraudulent certificate for the pinned domain. However, pinning does not dynamically check the revocation status of the *pinned* certificate itself; if the pinned certificate is legitimately revoked by its CA, the client will continue to trust it until its internal pin set is updated.

  • Self-Signed Certificates

    Why it's wrong here

    Self-signed certificates are digital certificates that are signed by their own private key, rather than by a trusted third-party Certificate Authority (CA). Because there is no external CA involved in their issuance or management, self-signed certificates inherently lack a formal revocation mechanism. There is no central authority to publish a Certificate Revocation List (CRL) or provide an Online Certificate Status Protocol (OCSP) response for such certificates, making them unsuitable for environments requiring robust revocation management.

About these practice questions

Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.