SOA-C02 Question 207
Single answerAn organization uses AWS Key Management Service (KMS) to manage encryption keys for securing sensitive data. The SysOps Administrator is tasked with ensuring that a specific KMS key cannot be accidentally deleted while still allowing its use for encrypting and decrypting data. What is the most appropriate action to achieve this?
- A
Enable key rotation for the KMS key.
- B
Attach a key policy denying the 'kms:DeleteKey' permission to all users.
- C
Mark the key as 'disabled' in the KMS console.
- D
Enable the 'key deletion protection' option for the KMS key.
Show answer and explanation
Correct answer: B
Explanation
To prevent accidental deletion of a KMS key while still allowing its use, you must implement a key policy that explicitly denies the 'kms:DeleteKey' action. This ensures that the key remains functional for encryption and decryption operations but cannot be deleted by any user or administrator. Other options, like enabling key rotation or disabling the key, do not provide the required protection against deletion or may impact the key's usability.
- A. Incorrect.
Enabling key rotation ensures that the key is rotated automatically at regular intervals, but it does not prevent the key from being deleted.
- B. Correct.
Attaching a key policy denying the 'kms:DeleteKey' permission to all users ensures that no one, including administrators, can delete the key while still allowing its use for encryption and decryption.
- C. Incorrect.
Disabling a key in KMS prevents it from being used for encryption or decryption but does not prevent the key from being deleted.
- D. Incorrect.
KMS does not have an explicit 'key deletion protection' feature. Protection from deletion is achieved through IAM or key policies.