Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company enables automatic annual key rotation for a customer managed key in AWS Key Management Service (AWS KMS) that is used to encrypt database backups. Which of the following describes how AWS KMS handles the encryption and decryption of existing and new backups after the rotation occurs?

  1. New backups are encrypted using the new key version, while existing backups remain encrypted under the previous key version, which AWS KMS retains to decrypt them transparently.Answer
  2. B
    AWS KMS immediately re-encrypts all existing database backups using the new key version to ensure uniform encryption.
  3. C
    The previous key version is deleted, requiring the administrator to manually decrypt and re-encrypt all existing backups using the new key version.
  4. D
    The existing database backups become inaccessible because AWS KMS only maintains the single active key version.

Answer

New backups are encrypted using the new key version, while existing backups remain encrypted under the previous key version, which AWS KMS retains to decrypt them transparently.
When automatic key rotation is enabled for a customer managed key, AWS KMS generates a new backing key version every year. The service uses the new key version only for new encryption requests. To ensure that previously encrypted data can still be decrypted, AWS KMS preserves all older versions of the backing key and uses them transparently during decryption requests.

Step-by-Step Solution

1
Understand how AWS KMS Customer Managed Keys rotate.
Enabling automatic rotation creates a new key version (a new backing key) annually.
This limits the amount of data encrypted under a single backing key version.
2
Determine the impact of rotation on existing data (ciphertext).
Existing backups are NOT re-encrypted. AWS KMS retains the previous key versions so they can still be decrypted.
Re-encrypting existing data would be resource-intensive and is not done automatically by AWS KMS.
3
Identify the active key version for new encryption requests.
Only new data is encrypted using the newly active key version.
This meets the key rotation objective of using new keys for new cryptographic operations going forward.

Key Concept

AWS KMS Automatic Key Rotation Mechanics
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic