What is a trust anchor?

Question

Options

• AA root certificate that is trusted by a particular CA
• BA list of public keys that are trusted by a particular CA
• CA list of private keys that are trusted by a particular CA
• DA key pair that is generated by a particular CA

• A
  89% (33)
• B
  3% (1)
• C
  3% (1)
• D
  5% (2)

Explanation

A trust anchor is a root certificate that is implicitly trusted - it forms the foundation of a Public Key Infrastructure (PKI) trust chain, and all other certificates are validated by tracing back to it. Option A is correct because a trust anchor is specifically a self-signed root certificate (not a list or key pair) whose trustworthiness is assumed rather than derived from another certificate.

• B is wrong because a trust anchor is a single certificate, not a list of public keys - public keys are contained within certificates, but the certificate itself (with its identity bindings) is what's trusted.
• C is wrong because private keys are never shared or distributed as trust anchors; trust anchors are always public-facing certificates.
• D is wrong because a key pair is just a cryptographic primitive - a trust anchor carries identity, validity period, and signature metadata that a raw key pair lacks.

Memory tip: Think of a trust anchor like an anchor on a ship - everything chains back to it and it doesn't move. The root CA certificate is that immovable starting point; your OS or browser pre-installs these so you don't have to verify them yourself.

No community discussion yet for this question.