Correct Answer: AWS KMS Customer Managed Key (CMK) with Automatic Annual Rotation
Customer Managed Keys (CMKs) support automatic annual rotation. Only the customer can manage the access policy to these keys via IAM/Key policies....
Correct Answer
AWS KMS Customer Managed Key (CMK) with Automatic Annual Rotation
Why This Answer Is Correct
Customer Managed Keys (CMKs) support automatic annual rotation. Only the customer can manage the access policy to these keys via IAM/Key policies.
This question evaluates your knowledge of AWS KMS — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding AWS KMS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
An organization wants to centralize the management of their secrets (API keys, DB passwords, etc.) across 50 AWS accounts. They want to ensure they can rotate passwords without downtime and audit who accessed the secrets. Which service is appropriate?
An organization is using Amazon S3 to store patient records. They must ensure that the records are encrypted at rest with keys that they rotate every 90 days and that AWS itself cannot access. Which KMS key configuration meets this requirement?
Which AWS security service allows you to automatically rotate your database passwords every 30 days and provides a managed way to inject these secrets into your Lambda functions without human intervention?
An organization wants to ensure that all their critical S3 buckets are encrypted with keys that only they physically possess in an on-premises HSM. Which KMS feature allows you to use your own HSM as the back-end for KMS encryption?