nerdexam
(ISC)2

CISSP · Question #1007

Which of the following is the MOST common use of the Online Certificate Status Protocol (OCSP)?

The correct answer is B. To obtain the revocation status of an X.509 digital certificate. OCSP is a protocol used to check whether a specific digital certificate has been revoked, providing a real-time alternative to downloading Certificate Revocation Lists (CRLs).

Submitted by hans_de· Mar 5, 2026Security Architecture and Engineering

Question

Which of the following is the MOST common use of the Online Certificate Status Protocol (OCSP)?

Options

  • ATo obtain the expiration date of an X.509 digital certificate
  • BTo obtain the revocation status of an X.509 digital certificate
  • CTo obtain the author name of an X.509 digital certificate
  • DTo verify the validity of an X.509 digital certificate

How the community answered

(43 responses)
  • A
    5% (2)
  • B
    91% (39)
  • C
    2% (1)
  • D
    2% (1)

Why each option

OCSP is a protocol used to check whether a specific digital certificate has been revoked, providing a real-time alternative to downloading Certificate Revocation Lists (CRLs).

ATo obtain the expiration date of an X.509 digital certificate

Expiration dates are embedded directly within the certificate's fields (notBefore/notAfter) and can be read without any external protocol query.

BTo obtain the revocation status of an X.509 digital certificateCorrect

OCSP was designed specifically to allow clients to query a Certificate Authority's OCSP responder and receive a real-time response indicating whether a given X.509 certificate is 'good,' 'revoked,' or 'unknown.' This is its primary and most common use case, defined in RFC 6960, enabling more efficient and timely revocation checking compared to traditional CRL downloads.

CTo obtain the author name of an X.509 digital certificate

The certificate author or issuer information is also a static field within the X.509 certificate itself and does not require an online protocol to retrieve.

DTo verify the validity of an X.509 digital certificate

While revocation status is one component of overall validity, OCSP's specific and defined purpose is revocation status checking, not broad validity verification, which encompasses additional checks such as signature validation and trust chain verification performed locally.

Concept tested: OCSP purpose and certificate revocation status checking

Source: https://datatracker.ietf.org/doc/html/rfc6960

Topics

#OCSP#PKI#certificate revocation#X.509

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISSP Practice