SAA-C03 Q591 · Security

Question

A company must follow strict regulations for the management of data encryption keys. The company manages its own key externally and imports the key into AWS Key Management Service (AWS KMS). The company must control the imported key material and must rotate the key material on a regular schedule. A solutions architect needs to import the key material into AWS KMS and rotate the key without interrupting applications that use the key. Which solution will meet these requirements?

Accepted Answer

**Answer C: Import new key material into the existing AWS KMS key. Set an expiration time for the old key material.**

Step-by-step reasoning:

1. **AWS KMS keys with imported key material** allow you to re-import new key material into the **same KMS key** (same Key ID and ARN). This is a unique capability of imported key material.

2. **No application disruption**: Since the KMS key ID and ARN remain the same, all applications, policies, and grants that reference this key continue to work seamlessly. There is no need to update key references anywhere.

3. **Key material rotation**: When you import new key material into an existing KMS key, the new key material **replaces** the old key material. This effectively rotates the cryptographic material while keeping the logical key identity inta

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips