A security engineer must develop an encryption tool for a company. The company requires a cryptographic solution that supports the ability to perform cryptographic erasure on all resources protected…

Question

Options

• AUse Imported key material with CMK
• BUse an AWS KMS CMK
• CUse an AWS managed CMK.
• DUse an AWS KMS customer managed CMK

• A
  21% (8)
• B
  10% (4)
• C
  64% (25)
• D
  5% (2)

Explanation

Note: The marked answer (C) appears to be incorrect. Based on AWS documentation, Option A (Imported key material with CMK) is the correct answer for this scenario.

When you import your own key material into a CMK, you can delete that key material immediately and on-demand - no waiting period required - rendering all protected resources cryptographically erased within minutes. This is precisely why AWS offers imported key material: to give customers full control over key destruction timelines for compliance scenarios.

Why the distractors are wrong:

• B (AWS KMS CMK) / D (Customer managed CMK) - Both require a mandatory 7–30 day waiting period before key deletion takes effect, making the "15 minutes or less" requirement impossible to meet.
• C (AWS managed CMK) - You have no direct control over deletion of AWS managed CMKs; AWS controls their lifecycle, so you cannot initiate cryptographic erasure on your own timeline.

Memory tip: Think "BYOK = BYOE" - Bring Your Own Key means Bring Your Own Erasure. Only when you own the key material can you delete it instantly. If AWS holds the key material (managed CMKs) or enforces a deletion window (customer managed CMKs without import), you lose that control.

Exam caution: If this question appears on a practice exam, the intended correct answer is A, not C. Verify against the source material before trusting the provided answer key.

No community discussion yet for this question.