Which statement best describes the role of OCSP in PKI?

• A. OCSP provides real-time revocation status
• B. CRLs publish revoked certs
• C. Both help ensure trust
• D. CRLs require online lookup

Answer: (A)

OCSP is used to check the status of a certificate on the fly. When a certificate is presented, the client asks an OCSP responder for that specific certificate’s status, and the responder replies with good, revoked, or unknown. This provides real-time revocation status, which is the key benefit of OCSP—quickly confirming whether a certificate is still trustworthy without downloading a full revocation list.

In contrast, certificate revocation lists are published periodically and can be large; they require retrieving the list to see if a particular certificate is revoked, which is slower and less efficient for on-demand checks. While both mechanisms serve to maintain trust, OCSP’s primary role is delivering up-to-date status for individual certificates, making it the best description.