diff --git a/libwvdrmengine/cdm/core/include/wv_cdm_constants.h b/libwvdrmengine/cdm/core/include/wv_cdm_constants.h
index 4222952a..6864aeb3 100644
--- a/libwvdrmengine/cdm/core/include/wv_cdm_constants.h
+++ b/libwvdrmengine/cdm/core/include/wv_cdm_constants.h
@@ -81,6 +81,7 @@ static const std::string QUERY_KEY_RESOURCE_RATING_TIER = "ResourceRatingTier";
 static const std::string QUERY_KEY_OEMCRYPTO_BUILD_INFORMATION =
     "OemCryptoBuildInformation";
 static const std::string QUERY_KEY_DECRYPT_HASH_SUPPORT = "DecryptHashSupport";
+static const std::string QUERY_KEY_PROVISIONING_MODEL = "ProvisioningModel";
 
 static const std::string QUERY_VALUE_TRUE = "True";
 static const std::string QUERY_VALUE_FALSE = "False";
@@ -100,6 +101,9 @@ static const std::string QUERY_VALUE_HDCP_V2_1 = "HDCP-2.1";
 static const std::string QUERY_VALUE_HDCP_V2_2 = "HDCP-2.2";
 static const std::string QUERY_VALUE_HDCP_V2_3 = "HDCP-2.3";
 static const std::string QUERY_VALUE_HDCP_LEVEL_UNKNOWN = "HDCP-LevelUnknown";
+static const std::string QUERY_VALUE_DRM_CERTIFICATE = "DrmCertificate";
+static const std::string QUERY_VALUE_KEYBOX = "Keybox";
+static const std::string QUERY_VALUE_OEM_CERTIFICATE = "OEMCertificate";
 
 static const std::string ISO_BMFF_VIDEO_MIME_TYPE = "video/mp4";
 static const std::string ISO_BMFF_AUDIO_MIME_TYPE = "audio/mp4";
diff --git a/libwvdrmengine/cdm/core/src/cdm_engine.cpp b/libwvdrmengine/cdm/core/src/cdm_engine.cpp
index 5f86b2bf..abea390c 100644
--- a/libwvdrmengine/cdm/core/src/cdm_engine.cpp
+++ b/libwvdrmengine/cdm/core/src/cdm_engine.cpp
@@ -672,6 +672,33 @@ CdmResponseType CdmEngine::QueryStatus(SecurityLevel security_level,
     *query_response =
         std::to_string(crypto_session->IsDecryptHashSupported(security_level));
     return NO_ERROR;
+  } else if (query_token == QUERY_KEY_PROVISIONING_MODEL) {
+    CdmClientTokenType token_type = kClientTokenUninitialized;
+    status = crypto_session->GetProvisioningMethod(security_level, &token_type);
+    if (status != NO_ERROR) {
+      LOGW("CdmEngine::QueryStatus: GetProvisioningMethod failed: %d", status);
+      return status;
+    }
+    switch (token_type) {
+      case kClientTokenDrmCert:
+        *query_response = QUERY_VALUE_DRM_CERTIFICATE;
+        break;
+      case kClientTokenKeybox:
+        *query_response = QUERY_VALUE_KEYBOX;
+        break;
+      case kClientTokenOemCert:
+        *query_response = QUERY_VALUE_OEM_CERTIFICATE;
+        break;
+      case kClientTokenUninitialized:
+      default:
+        LOGW(
+            "CdmEngine::QueryStatus: GetProvisioningMethod returns invalid "
+            "token type: %d",
+            token_type);
+        return GET_PROVISIONING_METHOD_ERROR;
+        break;
+    }
+    return NO_ERROR;
   }
 
   M_TIME(status = crypto_session->Open(security_level),
diff --git a/libwvdrmengine/cdm/test/request_license_test.cpp b/libwvdrmengine/cdm/test/request_license_test.cpp
index ffbfd4a6..a4823b68 100644
--- a/libwvdrmengine/cdm/test/request_license_test.cpp
+++ b/libwvdrmengine/cdm/test/request_license_test.cpp
@@ -4830,9 +4830,15 @@ TEST_F(WvCdmRequestLicenseTest, QueryStatus) {
   EXPECT_TRUE(!value.empty());
 
   EXPECT_EQ(wvcdm::NO_ERROR,
-            decryptor_->QueryStatus(kLevelDefault,
-                                   wvcdm::QUERY_KEY_CURRENT_SRM_VERSION,
-                                   &value));
+            decryptor_->QueryStatus(
+                kLevelDefault, wvcdm::QUERY_KEY_CURRENT_SRM_VERSION, &value));
+
+  EXPECT_EQ(wvcdm::NO_ERROR,
+            decryptor_->QueryStatus(
+                kLevelDefault, wvcdm::QUERY_KEY_PROVISIONING_MODEL, &value));
+  // These are the only valid values for Android devices.
+  EXPECT_TRUE(value == wvcdm::QUERY_VALUE_KEYBOX ||
+              value == wvcdm::QUERY_VALUE_OEM_CERTIFICATE);
 }
 
 TEST_F(WvCdmRequestLicenseTest, QueryStatusL3) {
@@ -4937,6 +4943,13 @@ TEST_F(WvCdmRequestLicenseTest, QueryStatusL3) {
   ASSERT_FALSE(ss.fail());
   EXPECT_TRUE(ss.eof());
   EXPECT_LE(10u, api_version);
+
+  EXPECT_EQ(wvcdm::NO_ERROR,
+            decryptor_->QueryStatus(
+                kLevel3, wvcdm::QUERY_KEY_PROVISIONING_MODEL, &value));
+  // These are the only valid values for Android devices.
+  EXPECT_TRUE(value == wvcdm::QUERY_VALUE_KEYBOX ||
+              value == wvcdm::QUERY_VALUE_OEM_CERTIFICATE);
 }
 
 TEST_F(WvCdmRequestLicenseTest, QueryOemCryptoSessionId) {