Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company stores sensitive files in an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key. The security team wants to ensure that the key material is rotated automatically every year to comply with internal guidelines. Which of the following statements correctly describe the behavior and configuration of AWS KMS automatic key rotation? (Select TWO.)

  1. AWS KMS automatically rotates the key material annually without requiring any changes to the application's key ARN or code.Answer
  2. Enabling automatic key rotation does not automatically re-encrypt historical data, and AWS KMS retains the older key material to decrypt existing data.Answer
  3. C
    Enabling automatic key rotation immediately decrypts and re-encrypts all existing data in the S3 bucket using the new key version.
  4. D
    When a key is rotated, the older key material is deleted, meaning older backups must be re-encrypted manually before rotation.
  5. E
    To support automatic rotation, the key's plaintext private key material must be saved in the AWS Systems Manager Parameter Store as a String parameter.

Answer

AWS KMS automatically rotates the key material annually without requiring any changes to the application's key ARN or code, and enabling automatic key rotation does not automatically re-encrypt historical data, with AWS KMS retaining the older key material to decrypt existing data.
AWS KMS automatic key rotation manages key material lifecycle seamlessly. It automatically generates a new version of the key material annually without modifying the key ID or ARN, ensuring applications require no changes. Additionally, it preserves historical key material versions so that existing data encrypted under those versions can be decrypted without needing immediate re-encryption.

Step-by-Step Solution

1
Identify the mechanics of AWS KMS customer managed key automatic rotation.
Understand that AWS KMS rotates key material once per year and maintains the key's metadata, including the ARN, unchanged.
This confirms that application configuration and code do not need to be updated.
2
Analyze how rotation affects existing historical data.
Recognize that rotation only applies to new data encryption; historical data remains encrypted with the old key material, which AWS KMS retains for decryption.
This establishes that existing data is not re-encrypted and old key versions are kept.

Key Concept

AWS KMS Automatic Key Rotation Mechanics
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic