A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK. What should the Security Engineer do to restore the deleted key material?

The correct answer is C. Download a new wrapping key and a new import token. The original wrapping key and import token expires after 24 hours. The question doesn't give us a timeframe, so we should assume that generating a new wrapping key and import token is the safer option. Then reimport the original key material and you will be good to go…

Submitted by marco_it· Mar 6, 2026Data Protection

Question

Options

ACreate a new CMK.
BCreate a new CMK.
CDownload a new wrapping key and a new import token.
DUse the original wrapping key and import token.

How the community answered

(49 responses)

A
12% (6)
B
8% (4)
C
78% (38)
D
2% (1)

Explanation

The original wrapping key and import token expires after 24 hours. The question doesn't give us a timeframe, so we should assume that generating a new wrapping key and import token is the safer option. Then reimport the original key material and you will be good to go. https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-

Topics

#AWS KMS#key material import#wrapping key#import token

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice