Good question.

I was in two minds whether to tick "certificates" or not: after all, Server Level principals like ##MS_PolicySigningCertificate##, ##MS_PolicyEventProcessingLogin##, and so on are certificate derived, some even include "Certificate" in their names, and given the general standard of questions I thought that there was an even chance that the question setter didn't distinguish these principals from the certificates from which they are derived. So I flipped a mental coin and came up with the wrong answer. If I'd known Steve had set the question I would have chosen differently. 😉