SCS-C02 Question 284
Single answerYour organization uses AWS Key Management Service (KMS) to manage encryption keys for sensitive data stored in Amazon S3. The security team has identified the need to ensure that encryption keys are rotated automatically every 12 months to adhere to compliance requirements. How can you achieve this in AWS?
- A
Enable automatic key rotation for the customer-managed key in AWS KMS.
- B
Use AWS Config to create a rule that enforces key rotation every 12 months.
- C
Manually rotate the key by creating a new key and updating all references to the old key.
- D
Enable server-side encryption with Amazon S3-managed keys (SSE-S3).
Show answer and explanation
Correct answer: A
Explanation
To meet compliance requirements for automatic key rotation in AWS KMS, you should enable automatic key rotation for customer-managed keys. This feature ensures that the key material is rotated every 12 months, simplifying compliance and reducing manual effort.
- A. Correct.
Correct: AWS KMS supports automatic key rotation for customer-managed keys. Enabling this feature ensures that keys are rotated automatically every 12 months.
- B. Incorrect.
Incorrect: AWS Config can monitor compliance, but it cannot enforce or automate key rotation in AWS KMS.
- C. Incorrect.
Incorrect: Manually rotating keys is an option, but it is not automatic and thus does not meet the requirement for automation.
- D. Incorrect.
Incorrect: Enabling server-side encryption with Amazon S3-managed keys (SSE-S3) delegates key management to AWS, and you cannot configure key rotation for S3-managed keys.