DVA-C02 · Question #751
A company has an application that runs on Amazon EC2 instances and stores sensitive data. The application encrypts the data by using an AWS KMS customer managed key with key material that has been imp
The correct answer is A. Create new key material from the original source outside of AWS. Reimport the key material to. When a KMS key with imported key material loses its material (e.g., due to expiration or deletion), it becomes unusable until new key material is reimported. The developer should regenerate or retrieve the original key material from the external source and reimport it to the same
Question
A company has an application that runs on Amazon EC2 instances and stores sensitive data. The application encrypts the data by using an AWS KMS customer managed key with key material that has been imported from outside of AWS. A developer accidentally deletes the key material, and the application is unable to read the encrypted data. What should the developer do to fix the application with the LEAST amount of effort?
Options
- ACreate new key material from the original source outside of AWS. Reimport the key material to
- BRecover the deleted key material by opening a request with AWS Support
- CGenerate an AWS managed KMS key. Reconfigure the application to use this key.
- DReimport the key material from the original source outside of AWS to the existing KMS key.
How the community answered
(52 responses)- A69% (36)
- B17% (9)
- C4% (2)
- D10% (5)
Explanation
When a KMS key with imported key material loses its material (e.g., due to expiration or deletion), it becomes unusable until new key material is reimported. The developer should regenerate or retrieve the original key material from the external source and reimport it to the same KMS key using the same key ID, restoring access to the encrypted data without needing re-encryption, which is the least effort solution.
Community Discussion
No community discussion yet for this question.