nerdexam
Amazon

DVA-C02 · Question #489

A developer manages encryption keys in AWS Key Management Service (AWS KMS). The developer must ensure that all encryption keys can be deleted immediately when the keys are no longer required. The dev

The correct answer is B. Use customer managed keys with imported key material. When the keys are no longer required,. Customer managed keys with imported key material are the only KMS key type that allows immediate deletion of the key material without a mandatory waiting period.

Submitted by ahmad_uae· Mar 5, 2026Security

Question

A developer manages encryption keys in AWS Key Management Service (AWS KMS). The developer must ensure that all encryption keys can be deleted immediately when the keys are no longer required. The developer wants a solution that is highly available and does not require manual management for compute infrastructure. Which solution will meet these requirements?

Options

  • AUse AWS KMS managed keys. When the keys are no longer required, schedule the keys for
  • BUse customer managed keys with imported key material. When the keys are no longer required,
  • CUse customer managed keys. When the keys are no longer required, delete the key material.
  • DUse customer managed keys and an AWS CloudHSM key store. When the keys are no longer

How the community answered

(42 responses)
  • A
    5% (2)
  • B
    57% (24)
  • C
    12% (5)
  • D
    26% (11)

Why each option

Customer managed keys with imported key material are the only KMS key type that allows immediate deletion of the key material without a mandatory waiting period.

AUse AWS KMS managed keys. When the keys are no longer required, schedule the keys for

AWS KMS managed keys (aws/service keys) cannot be deleted on demand by the user; they are managed entirely by AWS and tied to the service lifecycle.

BUse customer managed keys with imported key material. When the keys are no longer required,Correct

When using customer managed keys with imported key material, the key material can be deleted immediately using the DeleteImportedKeyMaterial API, which renders the key unusable instantly without any waiting period; this satisfies the immediate deletion requirement while AWS manages the underlying KMS infrastructure without requiring manual compute management.

CUse customer managed keys. When the keys are no longer required, delete the key material.

Standard customer managed keys (without imported key material) require a mandatory deletion waiting period of 7 to 30 days via the ScheduleKeyDeletion API and do not support immediate deletion.

DUse customer managed keys and an AWS CloudHSM key store. When the keys are no longer

An AWS CloudHSM key store requires provisioning and managing CloudHSM cluster instances, which violates the requirement to avoid manual management of compute infrastructure.

Concept tested: KMS imported key material for immediate key deletion

Source: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-delete-key-material.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DVA-C02 Practice