DVA-C02 Security Practice Question
A company uses AWS KMS customer master keys (CMKs) to encrypt sensitive data in Amazon S3. A compliance requirement mandates that the backing keys for the CMKs be automatically rotated every year. The developer must implement this with minimal operational overhead. Which solution meets the requirement?
⚠ Common exam trap
Test-takers frequently confuse AWS managed keys (which rotate automatically but not on a customer-defined schedule) with customer managed CMKs, or assume that manual key rotation is required when automatic rotation is available.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic key rotation for the CMK in AWS KMS.
AWS KMS supports automatic key rotation for customer managed CMKs. When enabled, KMS automatically rotates the backing key annually (approximately every 365 days) with no additional operational overhead. This satisfies the compliance requirement for yearly rotation without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable automatic key rotation for the CMK in AWS KMS.
Why this is correct
Enabling automatic key rotation for a CMK in AWS KMS ensures that the underlying cryptographic material (backing key) used for encryption is replaced annually. This process is transparent to applications, as the CMK's Amazon Resource Name (ARN) and Key ID remain unchanged, allowing existing encrypted data to still be decrypted by the original backing key. This fully automates the compliance requirement for annual key rotation without operational disruption.
- ✗
Create a new CMK every year and update the S3 bucket policy to use the new key.
Why it's wrong here
Manually creating a new CMK each year and updating S3 bucket policies is highly inefficient and prone to errors. This approach necessitates reconfiguring every service or application that references the old CMK, including updating S3 bucket policies and potentially re-encrypting existing objects with the new key. Such a manual process introduces significant operational overhead, increases the risk of misconfiguration, and does not scale effectively for large environments.
- ✗
Use an AWS managed key (aws/s3) which automatically rotates annually.
Why it's wrong here
Using an AWS managed key like aws/s3 would indeed provide automatic annual key rotation, but it fundamentally deviates from the requirement of using a Customer Master Key (CMK). AWS managed keys are controlled by AWS, meaning customers have no direct control over their key policies, access permissions, or detailed audit trails specific to their compliance needs. This lack of granular customer control over key management and auditing makes it unsuitable for scenarios requiring specific customer governance.
- ✗
Use SSE-S3 encryption with automatically rotated keys instead of KMS.
Why it's wrong here
SSE-S3 encryption relies on Amazon S3 managing the encryption keys, which are automatically rotated by AWS. While convenient for basic data protection, SSE-S3 does not leverage AWS KMS Customer Master Keys (CMKs), which is explicitly stated as the company's current practice and likely a compliance requirement. This method offers less granular control over key usage, access policies, and auditability compared to KMS CMKs, failing to meet advanced compliance and governance needs.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.