ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

In PGP's Web of Trust, there is no single, central certificate authority. Instead, individual users digitally sign one another's public keys after verifying identities through out-of-band means (for example, in person or via a known channel). A user's software can then evaluate chains of these signatures-trust paths-to decide whether to accept a key as valid. Publishing key fingerprints in DNS records can supplement distribution but is not the primary trust mechanism. Likewise, PGP does not rely on a hierarchical CA structure managed by IANA, nor can a sender derive a recipient's public key on demand using elliptic-curve operations; the key must already exist and be validated. Therefore, the option describing user signatures forming a web of endorsements is correct.