210-250 · Question #195
Which two of the following statements are true regarding the CA in a PKI deployment? (Choose two.)
The correct answer is A. The CA is the trusted third party that signs the public keys of entities in a PKI-based system. B. The CA issues either a certificate revocation list (CRL) or uses an OCSP process to determine. The CA is the trusted third party that signs entity certificates and manages revocation through CRL or OCSP. The CA is not a communications intermediary, and a root CA is required as the PKI trust anchor.
Question
Which two of the following statements are true regarding the CA in a PKI deployment? (Choose two.)
Options
- AThe CA is the trusted third party that signs the public keys of entities in a PKI-based system.
- BThe CA issues either a certificate revocation list (CRL) or uses an OCSP process to determine
- CThe CA becomes the center point of communications between two hosts using certificates that
- DA root CA is not necessary in a PKI.
How the community answered
(60 responses)- A92% (55)
- C3% (2)
- D5% (3)
Why each option
The CA is the trusted third party that signs entity certificates and manages revocation through CRL or OCSP. The CA is not a communications intermediary, and a root CA is required as the PKI trust anchor.
The CA is the trusted third party in a PKI deployment that uses its private key to digitally sign end-entity certificates, cryptographically binding each entity's identity to its public key so all parties trusting the CA can validate those certificates.
The CA is responsible for certificate revocation management - it either publishes a Certificate Revocation List (CRL) at regular intervals or operates an OCSP responder, giving relying parties a mechanism to check whether a certificate has been revoked before trusting it.
The CA does not sit in the middle of host-to-host communications - once certificates are issued, two hosts exchange data directly using each other's public keys, with no CA involvement in the actual communication session.
A root CA is required in PKI because it is the foundational trust anchor - it signs subordinate CAs or end-entity certificates directly, and without it there is no cryptographic basis for establishing a verifiable chain of trust.
Concept tested: CA role in PKI - signing authority and revocation management
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/active-directory-certificate-services-overview
Topics
Community Discussion
No community discussion yet for this question.