DVA-C02 Question 179
Single answerYou have an application running on AWS that uses a customer-managed AWS KMS key to encrypt sensitive data stored in an Amazon S3 bucket. To ensure compliance with your company's security policy, you need to implement key rotation. What is the BEST way to enable key rotation while minimizing application downtime?
- A
Enable automatic key rotation for your customer-managed KMS key in the AWS Management Console.
- B
Manually create a new key in AWS KMS, update your application to use the new key, and re-encrypt your data.
- C
Delete the old KMS key and create a new one with the same alias, ensuring the application uses the new key automatically.
- D
Enable automatic key rotation for the default AWS-managed KMS key instead of your customer-managed key.
Show answer and explanation
Correct answer: A
Explanation
Enabling automatic key rotation for customer-managed KMS keys in AWS is the best practice for maintaining security while minimizing manual effort and application downtime. AWS KMS automatically rotates the key material annually without requiring changes to the key ID or alias, ensuring continuity in encryption and decryption processes.
- A. Correct.
This is the correct approach because AWS KMS allows you to enable automatic key rotation for customer-managed keys. It ensures that the key material is rotated annually without requiring manual intervention or application changes.
- B. Incorrect.
While this approach can achieve key rotation, it involves manual effort to create a new key, update the application, and re-encrypt data, increasing the risk of human error or downtime.
- C. Incorrect.
Deleting the old key could lead to data loss if the key is still being used to decrypt existing data. Creating a new key with the same alias does not guarantee a seamless transition in AWS KMS.
- D. Incorrect.
Automatic key rotation for AWS-managed KMS keys is managed by AWS and cannot be enabled for customer-managed keys. This option would not apply to the described scenario.