CISSP Security Architecture and Engineering Practice Question
An organization is implementing a Public Key Infrastructure (PKI) to support secure email and web communications. The PKI includes a root CA, intermediate CAs, and end-entity certificates. Which of the following best describes the role of the root CA in this hierarchy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is self-signed and forms the trust anchor
The root CA is the top-level entity that signs its own certificate (self-signed) and issues certificates to intermediate CAs. It is the trust anchor for the entire PKI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It performs key escrow for all users
Why it's wrong here
Key escrow involves storing copies of private keys for recovery purposes, which is a specialized function typically handled by dedicated key recovery agents or specific intermediate CAs, not the foundational root CA. The root CA's primary role is to establish the trust hierarchy, and burdening it with key escrow would introduce unnecessary operational complexity and significant security risks to the most critical component of the PKI.
- ✗
It issues certificates directly to end users
Why it's wrong here
The root CA's private key is the most critical asset in a PKI and is typically kept offline and highly secured to prevent compromise. Direct issuance of certificates to end-users would necessitate frequent online access and signing operations by the root, drastically increasing its exposure to potential threats. This operational task is therefore delegated to intermediate CAs, which act as subordinate signing authorities, protecting the root from daily operational risks.
- ✗
It validates certificate revocation lists (CRLs)
Why it's wrong here
The root CA's function is to establish and sign the trust chain, not to perform ongoing validation checks of certificate status. Validation of Certificate Revocation Lists (CRLs) is a responsibility of the relying party (e.g., a web browser or application) that receives and needs to trust a certificate. While CAs *issue* CRLs to announce revoked certificates, they do not *validate* them; that is a client-side trust verification process.
- ✓
It is self-signed and forms the trust anchor
Why this is correct
The root CA's certificate is uniquely self-signed, meaning its public key is used to verify a signature created by its own private key, making it inherently self-authenticating. This self-signed certificate is then manually or automatically distributed and pre-installed as a trusted root in operating systems and applications. It serves as the ultimate trust anchor, the foundational point from which all other certificates in the PKI hierarchy derive their trustworthiness and validity.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.