Match each PKI component to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Issues and revokes certificates
Verifies identity before certificate issuance
List of revoked certificates
Binds a public key to an identity
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Certificate Authority (CA): Issues and signs digital certificates
In PKI, the CA issues and signs certificates, the RA verifies identities, the repository stores certificates for retrieval, and the CRL tracks revoked certificates. Common confusions involve mixing the roles of CA and RA or CA and repository.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Certificate Authority (CA): Issues and signs digital certificates
Why this is correct
A Certificate Authority (CA) is the cornerstone of a Public Key Infrastructure (PKI), acting as a trusted third party. Its primary function is to issue digital certificates, which cryptographically bind a public key to an identified entity, such as a user, server, or organization. The CA then digitally signs these certificates using its own private key, thereby vouching for the authenticity and integrity of the certificate's contents and establishing trust.
Registration Authority (RA): Verifies identity and requests certificate issuance
Why this is correct
A Registration Authority (RA) serves as an intermediary between the certificate applicant and the Certificate Authority (CA). Its critical role involves meticulously verifying the identity and legitimacy of individuals or entities requesting digital certificates according to established policies. Once identity verification is complete and all policy requirements are met, the RA forwards the validated certificate request to the CA for actual issuance and signing.
Certificate Repository: Stores and distributes public key certificates
Why this is correct
A Certificate Repository is a publicly accessible database or directory specifically designed to store and distribute issued digital certificates. Its purpose is to make certificates readily available to relying parties who need to retrieve and validate them for secure communication, authentication, or digital signature verification. Common implementations include Lightweight Directory Access Protocol (LDAP) directories or web-based repositories, ensuring efficient access to public key certificates.
Certificate Revocation List (CRL): Lists revoked certificates
Why this is correct
A Certificate Revocation List (CRL) is a time-stamped list maintained and digitally signed by a Certificate Authority (CA), containing the serial numbers of certificates that have been revoked prior to their scheduled expiration date. Certificates are revoked for various critical reasons, such as compromise of the private key, change of affiliation, or policy violations. Relying parties consult the CRL to ensure that a certificate they are presented with is still valid and has not been invalidated, thus preventing unauthorized use.
Certificate Authority (CA): Stores and distributes certificates
Why it's wrong here
This statement is incorrect because storing and distributing certificates is not the primary function of a Certificate Authority (CA). While a CA issues and signs certificates, the responsibility for making these certificates publicly available for retrieval by relying parties falls to the Certificate Repository. The CA's role is focused on the trust establishment and cryptographic issuance process, not ongoing storage and distribution.
Registration Authority (RA): Issues and signs certificates
Why it's wrong here
This statement is incorrect. A Registration Authority (RA) is responsible for verifying the identity of certificate applicants and facilitating the certificate request process by ensuring policy compliance. However, the RA does not possess the cryptographic keys or the authority to actually issue or digitally sign certificates. That critical function, which establishes the trust anchor and binds the public key to the identity, is exclusively performed by the Certificate Authority (CA).
Go deeper
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.