CISSP Security Architecture and Engineering Practice Question
A security architect is deploying a public key infrastructure (PKI) and wants to ensure that certificate revocation status is verified efficiently without relying on a centralized CRL distribution point. Which technique should be used?
⚠ Common exam trap
CISSP often tests the difference between OCSP Stapling (server-provided, cached revocation proof) and plain OCSP (client-to-responder lookup) — candidates pick Certificate Transparency or pinning because they sound security-related, but only stapling provides efficient decentralized revocation verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OCSP Stapling
OCSP Stapling allows the server to obtain a signed, time-stamped OCSP response from the CA and present it to clients during the TLS handshake, so clients do not need to contact the OCSP responder directly. This eliminates the latency and privacy concerns of real-time OCSP lookups and avoids reliance on a centralized CRL distribution point. It is the standard technique for efficient, decentralized revocation checking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Certificate Transparency Logs
Why it's wrong here
Certificate Transparency (CT) logs are public, append-only records designed to audit and monitor the issuance of SSL/TLS certificates by Certificate Authorities (CAs). Their primary purpose is to detect misissued or maliciously issued certificates by providing a transparent, verifiable record for domain owners and the public. However, CT logs do not provide real-time revocation status; they only record when a certificate was issued, not if it has subsequently been revoked.
- ✓
OCSP Stapling
Why this is correct
OCSP Stapling is an efficient method for web servers to provide clients with the revocation status of their own SSL/TLS certificates during the TLS handshake. The server periodically queries the Certificate Authority's (CA) Online Certificate Status Protocol (OCSP) responder for its certificate's status, caches the signed response, and "staples" it to the certificate sent to the client. This significantly improves privacy and performance by eliminating the need for each client to directly query the OCSP responder, reducing latency and server load.
- ✗
Certificate Pinning
Why it's wrong here
Certificate Pinning is a security mechanism where a client application or web browser is configured to expect a specific public key or certificate for a particular domain. This hardcoded trust relationship helps prevent man-in-the-middle attacks, even if a trusted Certificate Authority (CA) is compromised and issues a fraudulent certificate for the pinned domain. However, pinning does not dynamically check the revocation status of the *pinned* certificate itself; if the pinned certificate is legitimately revoked by its CA, the client will continue to trust it until its internal pin set is updated.
- ✗
Self-Signed Certificates
Why it's wrong here
Self-signed certificates are digital certificates that are signed by their own private key, rather than by a trusted third-party Certificate Authority (CA). Because there is no external CA involved in their issuance or management, self-signed certificates inherently lack a formal revocation mechanism. There is no central authority to publish a Certificate Revocation List (CRL) or provide an Online Certificate Status Protocol (OCSP) response for such certificates, making them unsuitable for environments requiring robust revocation management.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
TLS
Transport Layer Security (TLS) is a cryptographic protocol that encrypts data sent over the internet to keep it private and ensure it hasn’t been tampered with.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.