CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  To issue and digitally sign certificates

  Why this is correct

  A Certificate Authority (CA) serves as a trusted third party in a Public Key Infrastructure (PKI), primarily responsible for verifying the identity of entities (users, servers, organizations) and binding that identity to their public key. Upon successful verification, the CA issues a digital certificate, which it then cryptographically signs using its own private key. This digital signature assures recipients that the certificate is authentic, has not been tampered with, and was indeed issued by the stated CA, thereby establishing a chain of trust.

• ✗

  To revoke user passwords

  Why it's wrong here

  Revoking user passwords falls under the domain of identity and access management (IAM) systems, such as directory services (e.g., Active Directory, LDAP) or dedicated authentication servers. A Certificate Authority's function is specifically to manage digital certificates, which are used for authentication and encryption based on public-key cryptography, not for the management or revocation of traditional password-based credentials. These are distinct security mechanisms.

• ✗

  To generate random session keys

  Why it's wrong here

  Generating random session keys is a function performed by the communicating endpoints (client and server) during the establishment of a secure communication channel, such as a TLS/SSL handshake. These symmetric session keys are ephemeral and used for encrypting the actual data exchange for a single session. A Certificate Authority's role is to provide the public key infrastructure that enables the secure exchange of these session keys, not to generate the keys themselves.

• ✗

  To encrypt data between client and server

  Why it's wrong here

  The actual encryption of data exchanged between a client and a server is performed by the communicating parties themselves, utilizing cryptographic algorithms and keys established during a secure handshake. While a Certificate Authority provides the trusted certificates that facilitate the secure exchange of these keys (often symmetric session keys), it does not directly participate in or perform the real-time encryption of the data payload. Its role is foundational trust, not operational data encryption.

Go deeper

Related to this question