SSCP Cryptography Practice Question
A security team is implementing a PKI for a large enterprise. Which TWO of the following are commonly used methods for certificate revocation checking? (Select TWO.)
⚠ Common exam trap
The trap is confusing certificate lifecycle elements like CSR or key escrow with revocation checking mechanisms, or picking cryptographic algorithms like DSA that are unrelated to revocation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Online Certificate Status Protocol (OCSP)
Option B, Online Certificate Status Protocol (OCSP), is correct because it is a standard protocol defined in RFC 6960 that allows a client to query a dedicated OCSP responder in real time to determine whether a specific certificate has been revoked, returning a status of good, revoked, or unknown. Option C, Certificate Revocation List (CRL), is correct because it is a signed list published by the Certificate Authority (typically distributed via HTTP, LDAP, or FTP at the CDP extension URL) that enumerates the serial numbers of certificates that have been revoked before their expiration date. The remaining options are not revocation-checking methods: a Certificate Signing Request (A) is a message sent to a CA to request issuance of a certificate, Key Escrow (D) is the practice of storing private keys with a third party for recovery purposes, and the Digital Signature Algorithm (E) is a signing algorithm used to create and verify digital signatures, not to check revocation status.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Certificate Signing Request (CSR)
Why it's wrong here
A CSR is the applicant's request containing a public key and identity details, submitted before issuance; it carries no revocation status. It is tempting as a PKI enrolment artefact, and would be the right answer to a question asking how a subscriber requests a certificate from a CA.
- ✓
Online Certificate Status Protocol (OCSP)
Why this is correct
OCSP queries a responder for the real-time revocation status of a specific certificate, returning good, revoked or unknown. This satisfies the enterprise PKI requirement for a commonly used revocation checking method, offering lower latency than downloading a full list.
- ✓
Certificate Revocation List (CRL)
Why this is correct
A CRL is a signed list of revoked certificates published by the CA, which clients download and check locally. This satisfies the enterprise PKI requirement for a commonly used revocation checking method, providing a standard, widely supported mechanism.
- ✗
Key Escrow
Why it's wrong here
Key escrow stores private keys with a trusted third party for recovery, so it never queries revocation status. It is tempting because it also involves certificate lifecycle management, and would be correct where an organisation must recover encrypted data after an employee leaves or loses a key.
- ✗
Digital Signature Algorithm (DSA)
Why it's wrong here
DSA is a signing algorithm used to generate and verify digital signatures, not a revocation-checking protocol. It is tempting because it underpins certificate signatures, and would be correct if the question asked which algorithm a CA uses to sign certificates rather than how clients check revocation.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a method to check the revocation status of a digital certificate in real-time without the client downloading a full list?
easy- A.Certificate Revocation List (CRL)
- B.Self-signed certificate validation
- ✓ C.Online Certificate Status Protocol (OCSP)
- D.Certificate Transparency (CT)
Why C: OCSP (Online Certificate Status Protocol) lets a client query a responder in real time for the revocation status of a specific certificate, returning 'good,' 'revoked,' or 'unknown' without downloading the entire CRL. It is defined in RFC 6960 and is the standard real-time alternative to CRLs. This matches the requirement exactly.
Variation 2. A company is implementing a PKI for internal use. What is the primary purpose of a Certificate Revocation List (CRL)?
medium- A.To validate certificate chains
- B.To encrypt certificate requests
- C.To store all issued certificates
- ✓ D.To publish revoked certificates
Why D: The primary purpose of a Certificate Revocation List (CRL) is to publish a list of certificates that have been revoked by the Certificate Authority (CA) before their scheduled expiration. This allows relying parties to verify that a certificate is still valid and has not been compromised, ensuring trust in the PKI.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.