DEA-C01 AWS KMS Practice Question
A company uses AWS KMS to encrypt data in Amazon S3 and RDS. They need to ensure that encryption keys are automatically rotated every year. Which KMS key type supports automatic annual rotation?
⚠ Common exam trap
Candidates may confuse customer managed keys with AWS managed keys and think that all KMS keys support automatic rotation equally. However, only AWS managed keys have automatic rotation enabled by default; customer managed keys require manual activation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS managed keys (aws/xxx)
AWS managed keys (AWS-managed KMS keys) have automatic rotation enabled by default every year, making option B correct. AWS owned keys are not visible to the customer and cannot be managed. Customer managed keys require explicit enabling of rotation, so they are not automatically rotated. Custom key stores do not support automatic rotation. Therefore, only AWS managed keys provide automatic annual rotation without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS owned keys
Why it's wrong here
AWS owned keys are used by AWS services and are not accessible to customers; they cannot be rotated by the customer.
- ✓
AWS managed keys (aws/xxx)
Why this is correct
Correct. AWS managed keys have automatic annual rotation enabled by default, providing seamless compliance with rotation policies.
- ✗
Customer managed keys
Why it's wrong here
Customer managed keys can have automatic rotation, but it must be explicitly enabled; they do not rotate automatically without configuration.
- ✗
Custom key stores
Why it's wrong here
Custom key stores are backed by an AWS CloudHSM cluster and do not support automatic key rotation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every year. Which key type should the company use?
medium- ✓ A.Use a customer managed key with automatic rotation enabled
- B.Use the default S3 managed encryption key (SSE-S3)
- C.Use an AWS managed key (aws/s3)
- D.Use a customer managed key with manual rotation
Why A: AWS KMS allows customer managed keys to have automatic rotation enabled, which rotates the key material annually. This satisfies the security team's requirement for automatic yearly rotation while keeping customer control over the key. Option D (manual rotation) does not meet the automatic rotation requirement. AWS managed keys (C) also rotate automatically but are not customer managed, and SSE-S3 (B) is not a KMS key type.
Variation 2. A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type should be used to meet this requirement without manual intervention?
medium- ✓ A.Use a customer managed key with automatic rotation enabled.
- B.Use an imported key material because it supports automatic rotation.
- C.Use a KMS key generated by S3 on each object upload.
- D.Use an AWS managed key (aws/s3).
Why A: AWS customer managed keys (CMKs) with automatic rotation enabled rotate every year, meeting the requirement of annual rotation. While enabling automatic rotation requires a one-time manual configuration, after that no further manual intervention is needed, and the rotation occurs automatically. AWS managed keys (aws/s3) rotate automatically every three years, not annually, so they do not satisfy the yearly rotation requirement. Imported key material cannot be rotated, and S3 does not generate a KMS key per upload. Therefore, option A is correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.