SCS-C03 · Question #131
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 123456789012. The attack created workloads that are distributed across multiple AWS…
The correct answer is A. Log in to the account by using the account root user credentials. Re-issue the deletion request for. AWS KMS enforces a mandatory minimum waiting period of 7 days before a customer managed key can be deleted. According to AWS Certified Security - Specialty incident response guidance, no method exists to immediately delete a KMS key. The fastest possible deletion is achieved by…
Question
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 123456789012. The attack created workloads that are distributed across multiple AWS Regions. The security engineer contains the attack and removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions. The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of arn:aws:kms:us-east-2:123456789012:key/mrk- 0bb0212cd9864fdea0dcamzo26efb5670. The security engineer must delete the key as quickly as possible. Which solution will meet this requirement?
Options
- ALog in to the account by using the account root user credentials. Re-issue the deletion request for
- BIdentify the other Regions where the KMS key ID is present and schedule the key for deletion in 7
- CUpdate the IAM principal to allow kms:* permissions on the KMS key ARN. Re-issue the deletion
- DDisable the KMS key. Re-issue the deletion request for the KMS key in 30 days.
How the community answered
(42 responses)- A74% (31)
- B17% (7)
- C5% (2)
- D5% (2)
Explanation
AWS KMS enforces a mandatory minimum waiting period of 7 days before a customer managed key can be deleted. According to AWS Certified Security - Specialty incident response guidance, no method exists to immediately delete a KMS key. The fastest possible deletion is achieved by scheduling deletion with the minimum 7-day waiting period. In this scenario, although deletion was previously scheduled, the key remains enabled and usable. The most authoritative and reliable method to regain control and reissue deletion immediately is to use the AWS account root user, which has implicit permissions to manage KMS keys regardless of compromised IAM principals.
Topics
Community Discussion
No community discussion yet for this question.