SY0-701 General Security Concepts Practice Question
After an internal PKI was rebuilt, users now see certificate warnings when connecting to the company intranet portal. The portal certificate chains to a new CA, but endpoint trust stores do not recognize it yet. What should the administrator deploy?
⚠ Common exam trap
Test-takers frequently confuse distributing the root CA certificate with distributing the private key or generating a CSR, but the core concept is that trust is established by adding the root CA to the trusted store, not by modifying the portal or endpoints' certificates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The root CA certificate for the new PKI to trusted endpoint stores.
The root CA certificate must be distributed to all endpoint trust stores to establish trust in the new PKI. Without the root CA in the trusted root certification authorities store, the certificate chain is incomplete, causing browsers to display certificate warnings. Deploying the root CA certificate via Group Policy or MDM resolves this by allowing endpoints to validate the portal's certificate chain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The portal's private key so users can validate the certificate locally.
Why it's wrong here
Distributing the portal's private key would allow any recipient to impersonate the portal and decrypt or forge TLS traffic, so it must remain secret on the server. Trust in a certificate is established by validating the certificate chain against a trusted root CA, not by possessing the server's private key. Moreover, a private key cannot be used by clients to validate the certificate locally; validation requires the issuer's public key and the CA's signature.
- ✓
The root CA certificate for the new PKI to trusted endpoint stores.
Why this is correct
Correct. Endpoint trust stores need the trusted root certificate so they can validate the certificate chain presented by the intranet portal. Once the root CA is trusted, the browser can build a chain of trust from the portal certificate through any intermediate certificates back to the root. This resolves the warning without exposing private keys.
- ✗
A new certificate signing request on each endpoint.
Why it's wrong here
A certificate signing request (CSR) is a message sent to a CA to request a new certificate, containing the applicant's public key and identity details signed by the corresponding private key. Installing a CSR on endpoints would not add any trust anchor to their stores, because a CSR does not contain a CA-signed certificate and cannot be used to verify an existing certificate chain. Endpoint trust stores need the CA's self-signed root certificate, not a CSR, to validate the portal's certificate.
- ✗
A self-signed certificate on the portal to avoid future CA problems.
Why it's wrong here
Creating a self-signed certificate on the portal would make the portal its own CA, but browsers and OSes do not inherently trust self-signed certificates, so the warning would persist until that certificate is explicitly added to every endpoint's trust store. Unlike distributing a root CA certificate, this approach scales poorly because every future portal certificate would need to be re-installed, and it does not support intermediate CAs or certificate revocation. It would also leave the same trust-warning problem during any renewal or replacement.
Visual reference
Go deeper
Related to this question
Learn chapter
Zero Trust Architecture
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Group Policy
Group Policy is a Windows-based feature that allows administrators to centrally manage and enforce settings for users and computers across an organization.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.