Certified Ethical Hacker (CEH) Practice Question

OCSP stapling lets the server fetch a time-stamped revocation response from the certificate authority in advance and "staple" it to the TLS handshake. Because clients receive the OCSP data directly from the server, they no longer have to contact the CA themselves. This lowers connection latency (one less round-trip) and prevents the CA from seeing which specific sites a user visits, improving user privacy.

The distractors are incorrect for these reasons:

• Embedding an OCSP response does not establish perfect forward secrecy; that is achieved with ephemeral key exchange methods such as ECDHE, not OCSP stapling.
• Intermediate CA certificates may still need to be sent; stapling only adds revocation information, not the entire chain.
• The certificate is always sent in plaintext; stapling does not encrypt it, so it is not a direct countermeasure to man-in-the-middle attacks.