SAA-C03 · Question #390
A company must follow strict regulations for the management of data encryption keys. The company manages its own key externally and imports the key into AWS Key Management Service (AWS KMS). The…
The correct answer is C. Import new key material into the existing AWS KMS key. Set an expiration time for the old key. When using imported key material with AWS KMS, you maintain control over the key lifecycle. AWS KMS allows you to import new key material into an existing KMS key (of type "external" or "imported"), thus rotating the key material without changing the key ID or ARNs. This…
Question
A company must follow strict regulations for the management of data encryption keys. The company manages its own key externally and imports the key into AWS Key Management Service (AWS KMS). The company must control the imported key material and must rotate the key material on a regular schedule. A solutions architect needs to import the key material into AWS KMS and rotate the key without interrupting applications that use the key. Which solution will meet these requirements?
Options
- ACreate a new AWS KMS key that has the same key ID as the existing key. Import new key
- BSchedule the existing AWS KMS key for deletion. Create a new KMS key that has new key
- CImport new key material into the existing AWS KMS key. Set an expiration time for the old key
- DEnable automatic key rotation for the existing AWS KMS key.
How the community answered
(37 responses)- A24% (9)
- B5% (2)
- C59% (22)
- D11% (4)
Explanation
When using imported key material with AWS KMS, you maintain control over the key lifecycle. AWS KMS allows you to import new key material into an existing KMS key (of type "external" or "imported"), thus rotating the key material without changing the key ID or ARNs. This enables applications to continue using the same key for cryptographic operations without disruption. You can also set an expiration time for the old key material, after which AWS KMS deletes the old material and requires new key material to be imported, enforcing regular rotation per your compliance requirements.
Community Discussion
No community discussion yet for this question.