SSCP Cryptography Practice Question
An organization uses a PKI with a root CA that issues certificates to intermediate CAs, which then issue end-entity certificates. A client receives an end-entity certificate signed by an intermediate CA. During validation, which certificates are required to build the chain of trust?
⚠ Common exam trap
Many exam-takers assume the root CA directly signs all certificates, forgetting that intermediate CAs are used in practice, so they incorrectly select Option C or D, missing the need for the full chain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
End-entity certificate, intermediate CA certificate, and root CA certificate
In a PKI hierarchy, the chain of trust requires each certificate in the path to be validated up to a trusted root. The client must have the end-entity certificate, the intermediate CA certificate (to verify the end-entity's signature), and the root CA certificate (to verify the intermediate CA's signature). Without the intermediate CA certificate, the client cannot cryptographically link the end-entity to the root, breaking the chain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only the root CA certificate
Why it's wrong here
The root certificate alone cannot verify the end-entity certificate, because the intermediate CA's signature on it is unverified; the intermediate certificate is missing from the chain. Root-only validation tempts when administrators assume trust anchors suffice, but that scenario applies only when the root directly issues end-entity certificates.
- ✓
End-entity certificate, intermediate CA certificate, and root CA certificate
Why this is correct
Validation requires the full chain from the end-entity certificate up through the issuing intermediate CA to the trusted root CA, because each signature must be verified against its issuer's public key until a trust anchor is reached.
- ✗
Only the end-entity certificate and the root CA certificate
Why it's wrong here
Omitting the intermediate CA certificate breaks the chain: the root cannot directly verify the end-entity certificate, since the intermediate signed it. End-entity plus root tempts when the hierarchy is assumed flat, but that pairing only works when the root issues end-entity certificates directly.
- ✗
Only the end-entity certificate and the intermediate CA certificate
Why it's wrong here
Validation requires the root CA certificate as the trust anchor to verify the intermediate's signature; without it the chain terminates unverified. End-entity plus intermediate tempts because those two are transmitted together, but the client must already hold or fetch the root to complete path validation.
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.