SY0-301 · Question #48
Which of the following is used to certify intermediate authorities in a large PKI deployment?
The correct answer is A. Root CA. In a PKI hierarchy, the root CA sits at the top of the trust chain and uses its self-signed certificate to sign and thereby certify the certificates of intermediate or subordinate CAs.
Question
Which of the following is used to certify intermediate authorities in a large PKI deployment?
Options
- ARoot CA
- BRecovery agent
- CRoot user
- DKey escrow
How the community answered
(30 responses)- A93% (28)
- B3% (1)
- D3% (1)
Why each option
In a PKI hierarchy, the root CA sits at the top of the trust chain and uses its self-signed certificate to sign and thereby certify the certificates of intermediate or subordinate CAs.
The root CA is the ultimate trust anchor in a PKI deployment. It issues and digitally signs the certificates of intermediate CAs, establishing the chain of trust that relying parties follow when validating end-entity certificates. This hierarchical structure allows the root CA to be kept offline and highly secured while intermediate CAs handle day-to-day certificate issuance.
A recovery agent is an entity authorized to decrypt data encrypted by other users for recovery purposes and has no role in certifying CA hierarchy members.
Root user is an operating system account with administrative privileges and is not a PKI component involved in certificate signing.
Key escrow is a mechanism for storing copies of encryption keys with a trusted third party for recovery and is unrelated to certifying intermediate authorities.
Concept tested: PKI hierarchy and root CA signing intermediate CAs
Source: https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/server-certificate-deployment-overview
Topics
Community Discussion
No community discussion yet for this question.