Exam AWS-SysOps topic 1 question 749 discussion

C is the correct answer

Enabling automatic key rotation in AWS KMS ensures that new cryptographic key material is generated automatically on a regular basis. When automatic key rotation is enabled for the EBS volume key, AWS KMS will handle the rotation process for you, generating new key material while maintaining the ability to decrypt data encrypted with the previous key material.

C. As my understanding, for a CMK it can be created by AWS-generated key material / import your own key material / create the key material in the AWS CloudHSM cluster associated with an AWS KMS custom key store. No matter which one, it can be either customer managed or AWS managed. On the other hand, for "automatic key rotation", it can happen on both customer managed or AWS managed CMKs, the difference is that one is optional for each 1 year and the other is required for each 3 years. Therefore, based on the description on this question, I took it as the SysOps is using a customer managed CMK (that's why he/she "wants" to rotate the key), so he/she just need to enable automatic key rotation via console or KMS API without creating a new CMK (especially it mentioned to ensure that the EBS volume encrypted with the "current key" remains readable ). https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-how-it-works

C is correct , The question say AWS-generated key material .. and customer managed CMK can be generated by material provided by aws or by importing material .. don't confuse it with AWS managed CMK which have rotation only each 3 years ..

C. Enable automatic key rotation of the EBS volume key in AWS KMS.

I'll go with C

Isn't the question mentioned that, Admin wants to use automatic Key rotation? In this case Ans C

B Keywords are: - AWS-generated key material - automatic key rotation “AWS KMS supports optional automatic key rotation only for customer managed CMKs.” https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

I prefer answer B reason being that AWS managed CMKs. You cannot manage key rotation for AWS managed CMKs. AWS KMS automatically rotates AWS managed CMKs every three years (1095 days). In order to enable key rotation for another year you need to create a new KEY and it will enable a yearly rotation - hence B being the best option me thinks.

Why "A" cannot be a valid answer ?