DVA-C02 Security Practice Question
Network Topology
A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?
⚠ Common exam trap
A common mix-up: candidates assume `CreateKey` only applies to CMKs, but AWS services also use this API for service-linked keys; however, the exam expects you to recognize that the event name is generic and the context (e.g., `userIdentity` or `requestParameters`) determines the key type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A new KMS customer master key was created.
The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An existing KMS key was rotated.
Why it's wrong here
This option is incorrect because KMS key rotation, while a critical security practice, is a distinct operation from key creation. For customer managed keys (CMKs), rotation involves generating new cryptographic material for an existing key, and the CloudTrail event would typically be related to `EnableKeyRotation` or an internal KMS event, not `CreateKey`. The `CreateKey` API specifically provisions a brand-new KMS key resource.
- ✗
A new database encryption key was created.
Why it's wrong here
This option is incorrect because the `CreateKey` API call is specific to the AWS Key Management Service (KMS) itself, not directly to a database service. While AWS databases like RDS or DynamoDB can use KMS keys for encryption, the CloudTrail event for `CreateKey` signifies the creation of the underlying KMS key resource. Database-specific events would typically involve actions like `CreateDBInstance` or `EnableEncryption` within the respective database service, which might then internally call KMS.
- ✓
A new KMS customer master key was created.
Why this is correct
This option is correct because the `CreateKey` API is the fundamental operation in AWS Key Management Service (KMS) used to provision a new Customer Master Key (CMK). A CMK is the primary resource you manage in KMS for cryptographic operations. Therefore, a CloudTrail lookup showing a `CreateKey` event precisely indicates that a new, unique KMS customer master key has been successfully generated and made available within the AWS account.
- ✗
A new service-linked key was created.
Why it's wrong here
This option is incorrect because service-linked keys are a specific category of KMS keys that AWS services create and manage automatically on your behalf when certain features are enabled. These keys are not directly created by a user calling the `CreateKey` API. Instead, the AWS service itself orchestrates their creation, and the CloudTrail event would typically reflect the service's action (e.g., enabling a feature) rather than a direct user-initiated `CreateKey` event.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.