SOA-C02 Question 205
Single answerA company is using AWS Key Management Service (KMS) to encrypt sensitive data in an S3 bucket. The SysOps Administrator is tasked with ensuring that the encryption keys are rotated automatically to meet compliance requirements. What is the MOST effective way to achieve this using AWS KMS?
- A
Enable automatic key rotation for the customer-managed key (CMK) in AWS KMS.
- B
Manually create a new key in KMS every year and update the S3 bucket with the new key.
- C
Use an AWS-managed key (AWS-KMS) as it rotates automatically without any configuration.
- D
Configure an S3 bucket policy to automatically rotate KMS keys every 365 days.
Show answer and explanation
Correct answer: A
Explanation
To ensure compliance with encryption key rotation policies, enabling automatic key rotation for customer-managed keys (CMKs) in AWS KMS is the most efficient and reliable approach. This feature ensures keys are rotated automatically every year without requiring manual intervention, reducing the risk of human error.
- A. Correct.
Correct: AWS KMS supports automatic key rotation for customer-managed keys (CMKs). Enabling this feature ensures compliance with key rotation policies without manual intervention.
- B. Incorrect.
Incorrect: Manually creating and updating keys is prone to human error and does not meet the requirement for automation.
- C. Incorrect.
Incorrect: While AWS-managed keys are automatically rotated, they cannot be managed or controlled directly by the customer, which may not meet compliance requirements for customer-managed keys.
- D. Incorrect.
Incorrect: S3 bucket policies do not support automatic rotation of KMS keys. Key rotation must be configured within AWS KMS.