The correct answer is "Difficulty in finding the prime factors of very large numbers".
Answer "Difficulty in finding the prime factors of very large numbers" applies to public key
algorithms such as Diffie-Hellman and Elliptic Curve.
Answer "Difficulty of multiplying two large prime numbers" is incorrect because it is easy to
multiply two large prime numbers.
Answer "Fact that only one key is used" refers to symmetric key encryption.

Explanation/Reference:
Explanation:
A typical PKI consists of hardware, software, policies and standards to manage the creation, administration, distribution and revocation of keys and digital certificates. Digital certificates are at the heart of PKI as they affirm the identity of the certificate subject and bind that identity to the public key contained in the certificate.
Incorrect Answers:
A: A public-key certificate contains a public key. However, it is the PKI (in particular the certificate authority) that verifies the subject's identity and binds the subject name to the public key value.
C: A secret key infrastructure is not a valid answer. A secret key can refer to a private key or more commonly to a shared key used in symmetric encryption.
D: A private key (and its corresponding public key) is usually generated by a user or application. The public key is then validated and signed by a CA. A private key does not bind a subject name to a public key value.
References:
http://searchsecurity.techtarget.com/definition/PKI

The implementation of changes to a system is the aspect that an internal technical security audit would best validate. An internal technical security audit is a type of audit that is conducted by the organization's own staff or a contracted third party, and that focuses on the technical aspects of the organization's information systems and assets, such as the configuration, the functionality, the performance, and the security. An internal technical security audit can help ensure that the information systems and assets comply with the organization's policies, standards, and regulations, and that they meet the organization's security and business objectives. The implementation of changes to a system is the aspect that an internal technical security audit would best validate, as it involves verifying that the changes that are made to the system are authorized, documented, tested, and approved, and that they do not adversely affect the security and the functionality of the system. The implementation of changes to a system is part of the change management process, which is a process that ensures that any changes to the organization's information systems and assets are controlled and managed, and that they align with the organization's security and business requirements. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 7: Security Operations, page 467. CISSP Practice Exam - FREE 20 Questions and Answers, Question 17.

The ultimate objective of information classification is to ensure that information assets receive an appropriate level of protection in accordance with their importance and sensitivity to the organization. Information classification is the process of assigning labels or categories to information based on criteria such as confidentiality, integrity, availability, and value. Information classification helps the organization to identify the risks and threats to the information, and to apply the necessary controls and safeguards to protect it. Information classification also helps the organization to comply with the legal, regulatory, and contractual obligations related to the information12. References: 1: Information Classification - Why it matters?32: ISO
27001 & Information Classification: Free 4-Step Guide4