You deployed two Online Responders to provide OCSP for your issuing enterprise CA. A hardware load balancer distributes traffic between them. You must ensure consistent revocation responses and proper scaling. What should you do? Choose two actions.
Choose an answer
Tap an option to check your answer.
Correct answer: Configure an OCSP responder array by exporting the revocation configuration from the first responder and importing it to the second; ensure both use the same OCSP Response Signing certificate., On each responder, configure the revocation provider to reference the issuing CA and its CRL/AIA locations; set appropriate refresh intervals..
Why this is the answer
To ensure consistent revocation responses and proper scaling with multiple OCSP responders behind a load balancer, they must function as an array. This is achieved by exporting the revocation configuration from the first responder and importing it to the second, critically ensuring both use the same OCSP Response Signing certificate. This allows the load balancer to direct requests to either responder without clients detecting a difference. Additionally, each responder needs to be configured with the correct revocation provider settings, pointing to the issuing CA and its CRL/AIA locations, with appropriate refresh intervals to keep their revocation data current. Increasing CRL publication frequency is not directly related to OCSP responder configuration. Installing the AD CS Enterprise CA role on responders is incorrect; responders are separate from CAs. Disabling nonce support might reduce CPU but compromises security and is not a primary step for consistency or scaling.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed