CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
In PKI, what is the primary role of a Certificate Authority (CA)?
⚠ Common exam trap
The trap is confusing the CA's signing/issuance role with encryption or key generation — candidates often think the CA encrypts traffic or generates session keys, but it only signs certificates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To issue and digitally sign certificates
A Certificate Authority (CA) is the trusted entity in a PKI that issues digital certificates and digitally signs them with its private key, thereby binding a public key to an identity. The CA's signature allows relying parties to verify that the certificate is authentic and has not been tampered with. This is the foundational trust role of a CA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To issue and digitally sign certificates
Why this is correct
A Certificate Authority (CA) serves as a trusted third party in a Public Key Infrastructure (PKI), primarily responsible for verifying the identity of entities (users, servers, organizations) and binding that identity to their public key. Upon successful verification, the CA issues a digital certificate, which it then cryptographically signs using its own private key. This digital signature assures recipients that the certificate is authentic, has not been tampered with, and was indeed issued by the stated CA, thereby establishing a chain of trust.
- ✗
To revoke user passwords
Why it's wrong here
Revoking user passwords falls under the domain of identity and access management (IAM) systems, such as directory services (e.g., Active Directory, LDAP) or dedicated authentication servers. A Certificate Authority's function is specifically to manage digital certificates, which are used for authentication and encryption based on public-key cryptography, not for the management or revocation of traditional password-based credentials. These are distinct security mechanisms.
- ✗
To generate random session keys
Why it's wrong here
Generating random session keys is a function performed by the communicating endpoints (client and server) during the establishment of a secure communication channel, such as a TLS/SSL handshake. These symmetric session keys are ephemeral and used for encrypting the actual data exchange for a single session. A Certificate Authority's role is to provide the public key infrastructure that enables the secure exchange of these session keys, not to generate the keys themselves.
- ✗
To encrypt data between client and server
Why it's wrong here
The actual encryption of data exchanged between a client and a server is performed by the communicating parties themselves, utilizing cryptographic algorithms and keys established during a secure handshake. While a Certificate Authority provides the trusted certificates that facilitate the secure exchange of these keys (often symmetric session keys), it does not directly participate in or perform the real-time encryption of the data payload. Its role is foundational trust, not operational data encryption.
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.