Correct Answer: Customer Managed Key (CMK) with Imported Key Material (manual rotation)
By importing your own key material into a CMK, you maintain full control over the key, but you must also manage the rotation manually....
Correct Answer
Customer Managed Key (CMK) with Imported Key Material (manual rotation)
Why This Answer Is Correct
By importing your own key material into a CMK, you maintain full control over the key, but you must also manage the rotation manually.
This question evaluates your knowledge of AWS KMS — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding AWS KMS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
You are designing a solution for an audit firm that needs to store encrypted data in S3 for 10 years. They require that the encryption keys are rotated annually and that no one, including AWS, can access the cleartext keys. Which AWS KMS key type and rotation should you use?
An organization wants to centralize the management of their secrets (API keys, DB passwords, etc.) across 50 AWS accounts. They want to ensure they can rotate passwords without downtime and audit who accessed the secrets. Which service is appropriate?
Which AWS security service allows you to automatically rotate your database passwords every 30 days and provides a managed way to inject these secrets into your Lambda functions without human intervention?
An organization wants to ensure that all their critical S3 buckets are encrypted with keys that only they physically possess in an on-premises HSM. Which KMS feature allows you to use your own HSM as the back-end for KMS encryption?