A company is running an application in the eu-west-1 Region. The application uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt sensitive data. The company plans to deploy…

Question

Options

• AUpdate the key policies in eu-west-1. Point the application in eu-north-1 to use the same
• BAllocate a new customer managed key to eu-north-1 to be used by the application that is
• CAllocate a new customer managed key to eu-north-1. Create the same alias name for both keys.
• DAllocate a new customer managed key to eu-north-1. Create an alias for eu--1. Change the

• A
  2% (1)
• B
  7% (3)
• C
  85% (35)
• D
  5% (2)

Explanation

AWS KMS keys are regional resources and cannot be used across Regions. According to AWS Certified Security - Specialty documentation, applications that are deployed in multiple Regions should use region-specific customer managed keys while referencing keys by alias instead of key By creating a new customer managed key in eu-north-1 and assigning it the same alias as the key in eu-west-1, the application code can continue to reference the alias without modification. Each Region resolves the alias to the correct local key, ensuring encryption continues to function Option A is invalid because KMS keys are regional. Option B requires application changes. Option D introduces unsupported alias patterns. AWS best practices recommend alias-based key references for multi-Region deployments.

No community discussion yet for this question.