To further complicate an answer to such questions...
When XP was released (eons ago), there were all sorts of licensing problems...and illegal duplication of XP install CDs.
At that time, a user merely any copy of XP and a valid license key...regardless of whether it was a dupe of another key...in order to install XP.
Additionally, OEMs (notably Dell) CDs with embedded keys were openly sold by various outlets in the same manner that what now are called MS Genuine XP CDs (distributed by Microsoft, with MS logo on CD) were.
Soooo...any CD reflecting the inclusion of SP2 may be one of these CDs.
In 2004, SP2 was released.
In 2005, PA came along, as a MS measure to combat piracy...the MS EULA was changed...and these OEM disks and licenses which had been sold openly befoe...disappeared from procurement possibilities for the average user.
So...to answer your question...there are legitimate and illegitimate CDs which reflect SP2. Some have valid keys, some have keys which MS has proclaimed to be illegal and relies on PA to prevent activation of these licenses.
For more detailed info on Windows versions and such...you can use Google and http://en.wikipedia.org/wiki/Microsoft_Windows
In essence, PA has become the point at which MS defines validity for any install of XP.