NGFW-ENGINEER · Question #105
An administrator is designing a public key infrastructure (PKI) integration for a large-scale deployment with thousands of users authenticating via client certificates. A key design goal is to…
The correct answer is B. OCSP provides real-time status for a certificate on demand, is more scalable, and uses less. OCSP enables on-demand, real-time validation of individual certificate status instead of downloading and storing large revocation lists, which makes it more scalable for large user populations, reduces memory and processing load on the firewall, and minimizes authentication…
Question
An administrator is designing a public key infrastructure (PKI) integration for a large-scale deployment with thousands of users authenticating via client certificates. A key design goal is to ensure that certificate revocation status is checked efficiently with minimal impact on firewall performance and minimal delay for the connecting user. What is the primary advantage of using the Online Certificate Status Protocol (OCSP) instead of certificate revocation lists (CRLs) in this scenario?
Options
- AOCSP allows the firewall to act as its own certificate authority (CA), and it simplifies certificate
- BOCSP provides real-time status for a certificate on demand, is more scalable, and uses less
- COCSP is an older, more widely supported protocol than CRLs. ensuring compatibility with all client
- DOCSP bundles all certificate statuses into a single, digitally signed file for faster downloads by the
How the community answered
(22 responses)- A5% (1)
- B91% (20)
- C5% (1)
Explanation
OCSP enables on-demand, real-time validation of individual certificate status instead of downloading and storing large revocation lists, which makes it more scalable for large user populations, reduces memory and processing load on the firewall, and minimizes authentication delay for users.
Topics
Community Discussion
No community discussion yet for this question.