In PKI revocation mechanisms, which statement is true?

• A. CRLs publish revoked certificates; OCSP provides real-time revocation status.
• B. OCSP provides real-time revocation status.
• C. Both CRLs and OCSP are used to verify revocation status depending on system configuration.
• D. CRLs are deprecated in PKI.

Answer: (C)

In PKI revocation, you verify whether a certificate is still trusted by checking either a published CRL or an OCSP response. CRLs are lists of revoked certificates that a CA periodically publishes, which you can download and inspect offline. OCSP, on the other hand, gives a real-time status by querying a responder about a specific certificate. Because deployments vary, many systems use both approaches or choose one based on needs such as offline verification, bandwidth, or real-time requirements. That flexibility is why the statement that both CRLs and OCSP are used to verify revocation status depending on system configuration is the accurate one. It’s not correct to say CRLs are deprecated, and OCSP isn’t the only method used in all environments.