SSCP Cryptography Practice Question
An organization uses a PKI with a root CA that issues certificates to intermediate CAs, which then issue end-entity certificates. A client receives an end-entity certificate signed by an intermediate CA. During validation, which certificates are required to build the chain of trust?
⚠ Common exam trap
Many exam-takers assume the root CA directly signs all certificates, forgetting that intermediate CAs are used in practice, so they incorrectly select Option C or D, missing the need for the full chain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
End-entity certificate, intermediate CA certificate, and root CA certificate
In a PKI hierarchy, the chain of trust requires each certificate in the path to be validated up to a trusted root. The client must have the end-entity certificate, the intermediate CA certificate (to verify the end-entity's signature), and the root CA certificate (to verify the intermediate CA's signature). Without the intermediate CA certificate, the client cannot cryptographically link the end-entity to the root, breaking the chain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only the root CA certificate
Why it's wrong here
The end-entity certificate must be validated against the chain.
- ✓
End-entity certificate, intermediate CA certificate, and root CA certificate
Why this is correct
All three are required to validate the chain from end-entity to the trusted root.
- ✗
Only the end-entity certificate and the root CA certificate
Why it's wrong here
The intermediate CA certificate is also needed to link the end-entity to the root.
- ✗
Only the end-entity certificate and the intermediate CA certificate
Why it's wrong here
The root CA certificate is needed to anchor trust.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.