SSCP Cryptography Practice Question
A security team is implementing a PKI for a large enterprise. Which TWO of the following are commonly used methods for certificate revocation checking? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Online Certificate Status Protocol (OCSP)
CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) are the two primary methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Certificate Signing Request (CSR)
Why it's wrong here
CSR is used to request a certificate.
- ✓
Online Certificate Status Protocol (OCSP)
Why this is correct
OCSP provides real-time status.
- ✓
Certificate Revocation List (CRL)
Why this is correct
CRL is a list of revoked certificates.
- ✗
Key Escrow
Why it's wrong here
Key escrow is for backup of keys.
- ✗
Digital Signature Algorithm (DSA)
Why it's wrong here
DSA is a signature algorithm.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a method to check the revocation status of a digital certificate in real-time without the client downloading a full list?
easy- A.Certificate Revocation List (CRL)
- B.Self-signed certificate validation
- ✓ C.Online Certificate Status Protocol (OCSP)
- D.Certificate Transparency (CT)
Why C: OCSP allows querying the CA's responder for the status of a specific certificate in real-time.
Variation 2. A company is implementing a PKI for internal use. What is the primary purpose of a Certificate Revocation List (CRL)?
medium- A.To validate certificate chains
- B.To encrypt certificate requests
- C.To store all issued certificates
- ✓ D.To publish revoked certificates
Why D: The primary purpose of a Certificate Revocation List (CRL) is to publish a list of certificates that have been revoked by the Certificate Authority (CA) before their scheduled expiration. This allows relying parties to verify that a certificate is still valid and has not been compromised, ensuring trust in the PKI.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.