Which is used to verify that a secure Web site is legitimate?

Active Directory is a directory service for managing users, computers, and other network resources within an organization, not for authenticating public websites.

Enterprise trust refers to trust relationships between different domains or organizations, primarily used for authentication and authorization within a corporate network, not for verifying external public websites.

A private key is part of a public-key cryptography pair, held secretly by the website server, and used to decrypt information encrypted with its corresponding public key and to digitally sign data, but it is the digital certificate (which contains the public key and identity information) that is presented to and verified by the client.

A digital certificate, issued by a trusted Certificate Authority, binds a public key to the identity of the website owner. When a user connects to a secure website (HTTPS), the browser verifies the certificate's authenticity and validity to ensure the site is legitimate and to establish a secure, encrypted connection.