SSCP Cryptography Practice Question
In a PKI, what is the role of the root Certificate Authority (CA)?
⚠ Common exam trap
Test-takers frequently assume the root CA directly issues end-user certificates or handles revocation, but the SSCP exam tests the understanding that the root CA's primary role is to serve as the immutable trust anchor, with operational tasks delegated to subordinate CAs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To be the trust anchor for the entire PKI hierarchy
The root Certificate Authority (CA) is the trust anchor in a Public Key Infrastructure (PKI) hierarchy. Its self-signed root certificate is the ultimate trust point from which all subordinate CA certificates and end-entity certificates derive their trust. Without a trusted root, the entire chain of trust collapses, as no certificate can be validated back to a trusted source.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To be the trust anchor for the entire PKI hierarchy
Why this is correct
The root CA sits at the top of the hierarchy and self-signs its own certificate, so every subordinate CA and end-entity certificate chains back to it. That position makes it the trust anchor, and its private key must be strictly offline-protected.
- ✗
To issue certificates directly to end users
Why it's wrong here
A root CA signs subordinate CA certificates rather than issuing end-entity certificates directly, keeping its private key offline; issuing to users would expose it to constant operational risk. It tempts because subordinate issuing CAs do exactly this, and that is the correct answer when the question asks who issues user certificates.
- ✗
To generate private keys for all users
Why it's wrong here
The root CA certifies keys; it never generates users' private keys, since key generation must occur on the subscriber's own system to preserve non-repudiation and sole possession. It tempts because CAs do generate key pairs for subscribers in some enrolment models, which would be correct if the stem described a key-generation service.
- ✗
To revoke certificates and publish CRLs
Why it's wrong here
Revocation and CRL publication are handled by the issuing CA or a dedicated CRL distribution point, not the offline root, which cannot respond to routine revocation traffic. It tempts because revocation is a genuine CA function, and a CRL publisher is the right answer when the stem asks how certificate status is distributed.
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.