Which entity is authorized to revoke, suspend, and restore certificates?

• A. Local Registration Authority (LRA)
• B. Registration Authority (RA)
• C. Trusted Agent (TA)
• D. PKI Sponsor

Answer: (A)

Local Registration Authority is the local administrator responsible for managing certificate lifecycle for users in its domain. Because it handles end-user requests and enforces the verification and policy steps locally, it is authorized to revoke, suspend, and restore certificates. The Registration Authority’s main role is to verify identities and approve certificate issuance, while the actual lifecycle actions are managed within its scope under policy. Trusted Agent and PKI Sponsor aren’t standard roles for performing these certificate lifecycle actions in typical PKI setups, so they don’t fit as the entity authorized to revoke, suspend, and restore.