Courseiva
Security Architecture and EngineeringmediumMultiple ChoiceObjective-mapped

CISSP Security Architecture and Engineering Practice Question

An organization is implementing a Public Key Infrastructure (PKI) to support secure email and web communications. The PKI includes a root CA, intermediate CAs, and end-entity certificates. Which of the following best describes the role of the root CA in this hierarchy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

It is self-signed and forms the trust anchor

The root CA is the top-level entity that signs its own certificate (self-signed) and issues certificates to intermediate CAs. It is the trust anchor for the entire PKI.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • It performs key escrow for all users

    Why it's wrong here

    Key escrow involves storing copies of private keys for recovery purposes, which is a specialized function typically handled by dedicated key recovery agents or specific intermediate CAs, not the foundational root CA. The root CA's primary role is to establish the trust hierarchy, and burdening it with key escrow would introduce unnecessary operational complexity and significant security risks to the most critical component of the PKI.

  • It issues certificates directly to end users

    Why it's wrong here

    The root CA's private key is the most critical asset in a PKI and is typically kept offline and highly secured to prevent compromise. Direct issuance of certificates to end-users would necessitate frequent online access and signing operations by the root, drastically increasing its exposure to potential threats. This operational task is therefore delegated to intermediate CAs, which act as subordinate signing authorities, protecting the root from daily operational risks.

  • It validates certificate revocation lists (CRLs)

    Why it's wrong here

    The root CA's function is to establish and sign the trust chain, not to perform ongoing validation checks of certificate status. Validation of Certificate Revocation Lists (CRLs) is a responsibility of the relying party (e.g., a web browser or application) that receives and needs to trust a certificate. While CAs *issue* CRLs to announce revoked certificates, they do not *validate* them; that is a client-side trust verification process.

  • It is self-signed and forms the trust anchor

    Why this is correct

    The root CA's certificate is uniquely self-signed, meaning its public key is used to verify a signature created by its own private key, making it inherently self-authenticating. This self-signed certificate is then manually or automatically distributed and pre-installed as a trusted root in operating systems and applications. It serves as the ultimate trust anchor, the foundational point from which all other certificates in the PKI hierarchy derive their trustworthiness and validity.

About these practice questions

This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.