nerdexam
CompTIA

SY0-501 · Question #467

User from two organizations, each with its own PKI, need to begin working together on a joint project. Which of the following would allow the users of the separate PKIs to work together without…

The correct answer is A. Trust model. When two organizations with separate PKIs need to collaborate, a trust model (specifically cross-certification or bridge CA trust) allows each PKI to recognize and validate certificates issued by the other, eliminating connection errors caused by untrusted certificate chains.

Submitted by minji_kr· Mar 4, 2026Security architecture

Question

User from two organizations, each with its own PKI, need to begin working together on a joint project. Which of the following would allow the users of the separate PKIs to work together without connection errors?

Options

  • ATrust model
  • BStapling
  • CIntermediate CA
  • DKey escrow

How the community answered

(26 responses)
  • A
    73% (19)
  • B
    15% (4)
  • C
    4% (1)
  • D
    8% (2)

Why each option

When two organizations with separate PKIs need to collaborate, a trust model (specifically cross-certification or bridge CA trust) allows each PKI to recognize and validate certificates issued by the other, eliminating connection errors caused by untrusted certificate chains.

ATrust modelCorrect

A trust model, specifically cross-certification or a bridge CA arrangement, enables two independent PKIs to mutually recognize each other's Certificate Authorities. By establishing this trust relationship, certificates issued by either organization's CA are considered valid by the other, allowing users to authenticate and communicate without certificate trust errors.

BStapling

Stapling (OCSP stapling) is a performance and privacy optimization that allows a web server to cache and present its own certificate revocation status, which does not address cross-organizational PKI trust issues.

CIntermediate CA

An Intermediate CA is a subordinate CA within a single PKI hierarchy used to delegate certificate issuance, but it does not by itself establish trust between two completely separate PKI infrastructures.

DKey escrow

Key escrow is a mechanism for storing copies of cryptographic keys with a trusted third party for recovery purposes, and has no role in establishing trust between two separate PKIs.

Concept tested: Cross-organizational PKI trust model establishment

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/cross-certification-and-qualified-subordination

Topics

#PKI#trust model#cross-certification#certificate interoperability

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice