A security administrator needs a locally stored record to remove the certificates of a terminated employee. Which of the following describes a service that could meet these requirements?

OCSP (Online Certificate Status Protocol) provides real-time certificate revocation status by querying an online responder and does not produce or store a local revocation record.

PKI (Public Key Infrastructure) is the overarching framework of policies, hardware, software, and procedures for managing digital certificates, not a specific revocation record or service.

A Certificate Authority (CA) is the entity that issues and signs certificates; while it publishes CRLs, the CA itself is not the locally stored record used to enumerate revoked certificates.

A CRL is a signed, time-stamped list published by a Certificate Authority that contains the serial numbers of all certificates that have been revoked before their expiration date. Unlike OCSP, which requires a real-time online query, a CRL can be downloaded and stored locally, satisfying the requirement for a locally stored record that administrators use to ensure revoked certificates - such as those belonging to a terminated employee - are no longer trusted.