nerdexam
Amazon

SAP-C02 · Question #810

A company runs an application on AWS. The application uses an Amazon Aurora MySQL database that is encrypted with the default AWS managed AWS KMS key. The company must implement a solution to rotate…

The correct answer is B. Create a new AWS managed KMS key with automatic rotation set for 180 days. Take a snapshot. To rotate an Aurora database encryption key when using a default AWS managed key, a new key must be introduced by taking a snapshot of the database and restoring it using the desired new KMS key. While the "180 days" automatic rotation for an AWS managed key is atypical, this…

Submitted by parkjh· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

A company runs an application on AWS. The application uses an Amazon Aurora MySQL database that is encrypted with the default AWS managed AWS KMS key. The company must implement a solution to rotate the database encryption key every 180 days. The solution must provide a notification if the encryption key is noncompliant with this standard. Which solution will meet these requirements?

Options

  • AConfigure the rotation period for the existing AWS managed KMS key to be 180 days.
  • BCreate a new AWS managed KMS key with automatic rotation set for 180 days. Take a snapshot
  • CCreate a new customer managed KMS key with automatic rotation set for 180 days. Take
  • DCreate a new customer managed KMS key with automatic rotation set for 180 days. Update the

How the community answered

(41 responses)
  • A
    7% (3)
  • B
    73% (30)
  • C
    5% (2)
  • D
    15% (6)

Why each option

To rotate an Aurora database encryption key when using a default AWS managed key, a new key must be introduced by taking a snapshot of the database and restoring it using the desired new KMS key. While the "180 days" automatic rotation for an AWS managed key is atypical, this method enables changing the encryption key to one with a new rotation policy.

AConfigure the rotation period for the existing AWS managed KMS key to be 180 days.

You cannot configure the rotation period for an existing AWS managed KMS key, as its rotation is managed by AWS on an annual schedule.

BCreate a new AWS managed KMS key with automatic rotation set for 180 days. Take a snapshotCorrect

The default AWS managed KMS key does not allow users to configure its rotation period; therefore, a new key is required. The correct way to apply a new encryption key to an existing encrypted Aurora database is to take a snapshot and then restore it, specifying the new key during the restore process.

CCreate a new customer managed KMS key with automatic rotation set for 180 days. Take

While customer managed KMS keys offer more control, the "automatic rotation set for 180 days" is not a standard configurable feature within AWS KMS for any key type; automatic rotation is annual.

DCreate a new customer managed KMS key with automatic rotation set for 180 days. Update the

The "automatic rotation set for 180 days" is not a standard configurable feature within AWS KMS. Furthermore, you cannot simply "update" an existing encrypted Aurora database instance to change its encryption key; it requires a snapshot and restore operation.

Concept tested: Aurora DB encryption key rotation

Source: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Security.html#Aurora.Overview.Security.Encryption

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice