Which of the following statements are true regarding the certificate of a Root CA? (Choose THREE correct answers.)

Question

Options

• AIt is a self-signed certificate.
• BIt does not include the private key of the CA.
• CIt must contain a host name as the common name.
• DIt has an infinite lifetime and never expires.
• EIt must contain an X509v3 Authority extension.

• A
  92% (22)
• C
  4% (1)
• D
  4% (1)

Explanation

A Root CA sits at the top of the public key infrastructure trust chain with no superior authority above it, which explains all three correct answers. Because there is no higher CA to sign it, the Root CA signs its own certificate (A), making the issuer and subject identical. Like all X.509 certificates, it contains only the public key - the private key is never embedded in any certificate (B), as exposing it would compromise the entire PKI. Root CA certificates also include the X.509v3 Authority Key Identifier extension (E), which even in a self-signed context identifies the key used for signing and aids certificate chain validation.

Why the distractors are wrong:

• C is false because the Common Name of a Root CA identifies the CA organization (e.g., "DigiCert Global Root CA"), not a hostname - hostnames in CN apply to end-entity (server) certificates.
• D is false because Root CA certificates do expire; they simply have very long lifetimes (often 20–25 years). Nothing in X.509 allows an infinite validity period.

Memory tip: Think "Root CAs are self-sufficient at the top" - they sign themselves (A), never expose their private key (B), and identify their own authority via the AKI extension (E). Any claim that they contain hostnames or live forever is a trap targeting confusion with server certificates or CA immortality myths.

No community discussion yet for this question.