200-201 Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Generates private keys for users

  Why it's wrong here

  A CA signs and issues certificates binding public keys to identities; it never generates users' private keys, which must stay secret with the subscriber. Key generation is performed by the end entity or its key store. The CA's signing role is tempting because it does handle key material, but only public keys within certificates.

• ✗

  Provides symmetric keys for session encryption

  Why it's wrong here

  A CA issues and signs digital certificates binding public keys to identities; it never generates or distributes symmetric session keys, which are negotiated separately by the communicating parties. The option tempts because CAs are trusted key authorities, but their role is asymmetric key certification, not bulk symmetric key distribution.

• ✗

  Encrypts data for secure transmission

  Why it's wrong here

  Encryption of transmitted data is performed by protocols such as TLS using session keys; the CA only vouches for the authenticity of public keys via signed certificates. Its role is trust establishment, not bulk data confidentiality. This is tempting because certificates enable encryption, but the CA itself does not encrypt traffic.

• ✓

  Issues and validates digital certificates

  Why this is correct

  The CA is the trusted third party within a PKI that issues digital certificates, binding a public key to a verified identity, and validates those certificates through its registration and revocation processes. This satisfies the stem's requirement for trusted certificate issuance and validation.