During PKI operations, which step verifies that a presented certificate chains to a trusted authority?

• A. Certificate validation by the client using a trust store
• B. IP address resolution
• C. DH parameter generation
• D. Data encryption with symmetric key

Answer: (A)

Verifying that a presented certificate chains to a trusted authority happens during certificate validation, when the client uses its trust store. The trust store holds root certificates that the client already trusts. During the handshake, the server presents its certificate (and any intermediates). The client checks that each certificate in the chain is properly signed by the next one up the chain and that the chain leads to a root certificate that exists in the trust store. It also confirms the certificates are currently valid (not expired or revoked) and that, for TLS, the hostname matches if applicable. If everything checks out, the certificate is trusted and the handshake can proceed; if not, trust cannot be established and the connection is rejected.

The other options don’t perform this trust verification: IP address resolution is simply translating a hostname to an IP, not assessing certificate trust; DH parameter generation is about setting up the key exchange; data encryption with a symmetric key deals with confidentiality, not validating certificate chains.