SAA-C03 Q694 · Security

Question

A company decides to use AWS Key Management Service (AWS KMS) for data encryption operations. The company must create a KMS key and automate the rotation of the key. The company also needs the ability to deactivate the key and schedule the key for deletion. Which solution will meet these requirements?

Accepted Answer

**Answer C: Create a symmetric customer managed KMS key. Enable automatic key rotation.**

Let's map each requirement to the solution:

1. **Create a KMS key**: Customer managed keys (CMKs) give the customer full control over key policies, enabling/disabling, and deletion scheduling. AWS managed keys and AWS owned keys do NOT give this level of control.

2. **Automate rotation of the key**: **Automatic key rotation is only supported for symmetric encryption KMS keys.** When enabled, AWS rotates the cryptographic material every year (configurable since March 2024: 90 days to 2560 days). The key ID, key ARN, and key alias remain the same — only the backing key material changes. Previously encrypted data does NOT need to be re-encrypted because AWS KMS retains all previous versions of the bac

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips