Which of the following describes a component of Public Key Infrastructure (PKI) where a copy of a private key is stored to provide third-party access and to facilitate recovery operations?

Key registry is not a standard PKI component - it does not describe a defined mechanism for storing private keys for third-party access or recovery.

A recovery agent is a user account or certificate granted the ability to decrypt data encrypted by others, but it describes the entity performing recovery, not the storage component that holds the private key copy.

A directory in PKI (such as an LDAP-based certificate store) is used to publish and look up public keys and certificates, not to securely store private key copies for recovery.

Key escrow is the practice of storing a duplicate copy of a private key with a designated escrow agent or secure repository so that authorized parties can retrieve it for recovery operations. It provides a safety net when users lose access to their keys while allowing audited third-party access under controlled conditions, which distinguishes it from normal key storage.