Question 354 of 724
Enable Automatic KMS Key Rotation
A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that all KMS keys are rotated every year. Which action should be taken?
Quick Answer
The answer is to enable automatic key rotation on the customer-managed KMS key. This is the correct action because AWS KMS handles annual rotation automatically for customer-managed keys, rotating the underlying cryptographic material each year while preserving the same key ID and ARN, so all existing encrypted data in S3 remains accessible without any application changes. On the AWS Certified Developer Associate DVA-C02 exam, this concept tests your understanding of the distinction between automatic rotation (available only for customer-managed keys) and manual rotation (required for AWS managed keys or imported key material). A common trap is assuming you must create a new key or rotate the key alias, but the exam expects you to know that enabling automatic rotation satisfies a yearly rotation policy with zero operational overhead. Memory tip: think “auto-annual” for customer-managed keys—AWS handles the yearly turnover, you just flip the switch.
⚠ Common exam trap
It's easy for candidates to think manual rotation or creating a new key is required because they confuse KMS key rotation with S3 bucket key rotation or assume that automatic rotation changes the key ID, which would break references to the key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic key rotation
AWS KMS supports automatic key rotation for customer-managed KMS keys. When enabled, KMS rotates the key material annually without requiring any manual intervention or application changes. This satisfies the security team's requirement for yearly rotation while maintaining the same key ID and existing encrypted data accessibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually rotate the KMS key every year
Why it's wrong here
Automatic rotation is available and preferred.
- ✗
Create a new KMS key and update all applications to use it
Why it's wrong here
Manual process, not required.
- ✓
Enable automatic key rotation
Why this is correct
KMS supports automatic annual rotation for symmetric keys.
- ✗
Use AWS CloudWatch Events to trigger a Lambda function that rotates the key
Why it's wrong here
AWS KMS does not support rotating a customer managed key via a Lambda function; key rotation is an internal KMS operation that can only be enabled or disabled through the key's rotation configuration, not triggered externally. This option is tempting because CloudWatch Events and Lambda are commonly used to automate periodic tasks, and in scenarios requiring custom cryptographic key rotation outside KMS (e.g., for client-side encryption keys), that combination would be the correct approach.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS KMS with customer managed keys to encrypt S3 objects. The security team requires automatic key rotation. What must the developer do to enable rotation?
hard- A.Use AWS managed keys instead of customer managed keys
- B.Rotation is enabled by default for all KMS keys
- ✓ C.Enable automatic key rotation in the KMS key settings
- D.Create a new key and update the alias to point to the new key annually
Why C: For customer managed KMS keys, automatic key rotation can be enabled in the key management console or via the AWS CLI. Option A is incorrect because AWS managed keys rotate automatically, but the requirement specifies customer managed keys. Option B is incorrect because rotation is not enabled by default for customer managed keys; it must be enabled manually. Option D is incorrect because while you could manually rotate by creating a new key and updating the alias, the question asks what must be done to enable rotation, and the simplest and correct method is to enable automatic key rotation in the KMS key settings. Therefore, Option C is correct.
Variation 2. A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated every 90 days. Which key type should the company use to meet this requirement with minimal operational overhead?
medium- A.Customer managed KMS key with manual rotation
- ✓ B.Customer managed KMS key with automatic rotation enabled
- C.AWS managed KMS key
- D.AWS owned KMS key
Why B: Customer managed KMS keys support automatic rotation with a configurable rotation period. You can set the rotation period to 90, 180, or 365 days when enabling automatic rotation. This allows the company to meet the 90-day rotation requirement with minimal operational overhead, as AWS handles the rotation automatically. AWS managed keys and AWS owned keys do not allow custom rotation periods, and manual rotation (option A) requires significant overhead.
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.