SK0-004 · Question #78
In a PKI, which of the following represents the top level of a certificate authority?
The correct answer is A. Root CA. The Root CA is the top-level trust anchor in a PKI hierarchy, with all other certificate authorities deriving their trusted status from it.
Question
In a PKI, which of the following represents the top level of a certificate authority?
Options
- ARoot CA
- BIntermediate CA
- CSubordinate CA
- DDelegated CA
How the community answered
(25 responses)- A92% (23)
- B4% (1)
- D4% (1)
Why each option
The Root CA is the top-level trust anchor in a PKI hierarchy, with all other certificate authorities deriving their trusted status from it.
The Root CA sits at the apex of the PKI hierarchy and is the ultimate trust anchor for all certificates issued within that PKI. Its certificate is self-signed, meaning no higher authority vouches for it - its trustworthiness is established by distributing its certificate directly into client trust stores. All intermediate and subordinate CAs in the hierarchy obtain their trust by chaining back to the Root CA.
An Intermediate CA sits one level below the Root CA and issues certificates on its behalf, but it is not the top-level authority in the hierarchy.
A Subordinate CA is any CA that is beneath the Root CA in the trust chain, including intermediate CAs, and therefore does not represent the top level.
Delegated CA is not a standard PKI term for a top-level authority; the concept implies authority granted from a higher-level CA, placing it below the Root.
Concept tested: PKI certificate authority trust hierarchy
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/active-directory-certificate-services-overview
Topics
Community Discussion
No community discussion yet for this question.