Which three fields are within an X.509v3 end entity certificate? (Choose three).

Private keys are never included in a certificate because certificates are public documents; embedding a CA private key would catastrophically compromise the entire PKI trust chain.

The digital signature field holds the certificate authority's cryptographic signature over the certificate's contents, which allows relying parties to verify that the certificate was issued by a trusted CA and has not been tampered with.

The CA's own public key resides in the CA's certificate, not in the end entity certificate it signs; an end entity certificate contains only the subject's public key, not the issuer's.

The Subject Public Key Info field is a mandatory component of every X.509 certificate and contains the public key belonging to the named subject, used by others for encryption and signature verification operations.

The Basic Constraints extension is a standard X.509v3 extension that identifies whether the certificate subject is a CA or an end entity, and optionally enforces a maximum certification path length for subordinate CAs.

X.509v3 certificates do not contain a 'revocation authority for use when the certificate expires' because expiry and revocation are separate mechanisms; revocation information during a certificate's validity period is conveyed via CRL Distribution Points or OCSP Responder extensions.