- A
Customer managed KMS key with manual rotation
Why wrong: Manual rotation requires you to create a new key and update your applications to use it, which adds significant operational overhead. This does not meet the minimal overhead requirement.
- B
Customer managed KMS key with automatic rotation enabled
Correct. Customer managed KMS keys with automatic rotation allow you to set a rotation period of 90 days, meeting the requirement with minimal overhead.
- C
AWS managed KMS key
Why wrong: AWS managed keys have a fixed rotation policy (typically every 3 years) that cannot be customized to 90 days.
- D
AWS owned KMS key
Why wrong: AWS owned keys are used by AWS services on your behalf and cannot have custom rotation schedules.
Question 372 of 1,616
Enabling Automatic KMS Key Rotation
This DVA-C02 practice question tests your understanding of security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: customer managed KMS key. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated every 90 days. Which key type should the company use to meet this requirement with minimal operational overhead?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer managed KMS key with automatic rotation enabled
Customer managed KMS keys support automatic rotation with a configurable rotation period. You can set the rotation period to 90, 180, or 365 days when enabling automatic rotation. This allows the company to meet the 90-day rotation requirement with minimal operational overhead, as AWS handles the rotation automatically. AWS managed keys and AWS owned keys do not allow custom rotation periods, and manual rotation (option A) requires significant overhead.
Key principle: Customer managed KMS key
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer managed KMS key with manual rotation
Why it's wrong here
Manual rotation requires you to create a new key and update your applications to use it, which adds significant operational overhead. This does not meet the minimal overhead requirement.
- ✓
Customer managed KMS key with automatic rotation enabled
Why this is correct
Correct. Customer managed KMS keys with automatic rotation allow you to set a rotation period of 90 days, meeting the requirement with minimal overhead.
Related concept
Customer managed KMS key
- ✗
AWS managed KMS key
Why it's wrong here
AWS managed keys have a fixed rotation policy (typically every 3 years) that cannot be customized to 90 days.
- ✗
AWS owned KMS key
Why it's wrong here
AWS owned keys are used by AWS services on your behalf and cannot have custom rotation schedules.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Candidates may mistakenly believe that automatic rotation for customer managed KMS keys is fixed at 365 days. However, AWS KMS allows you to choose a rotation period of 90, 180, or 365 days when enabling automatic rotation, so option B meets the 90-day requirement.
Detailed technical explanation
How to think about this question
Under the hood, KMS automatic rotation for customer managed keys creates new backing key material every year while retaining the old material for decryption of previously encrypted data. The key ID and key ARN remain the same, so applications do not need to be updated. For a strict 90-day rotation, you would need to use imported key material in a custom key store and manually re-import new material every 90 days, or use automatic rotation with a custom key store that supports a 90-day rotation period (though this is not a standard KMS feature). The exam often tests the distinction between key rotation and key re-import scenarios.
KKey Concepts to Remember
- Customer managed KMS key
- Automatic key rotation
- Key rotation period
- Minimal operational overhead
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Customer managed KMS key
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
What to study next
Got this wrong? Here's your next step.
Review customer managed KMS key, then practise related DVA-C02 questions on the same topic to reinforce the concept.
- →
Security — study guide chapter
Learn the concepts, then practise the questions
- →
Security practice questions
Targeted practice on this topic area only
- →
All DVA-C02 questions
1,616 questions across all exam domains
- →
AWS Certified Developer Associate DVA-C02 study guide
Full concept coverage aligned to exam objectives
- →
DVA-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related DVA-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Development with AWS Services practice questions
Practise DVA-C02 questions linked to Development with AWS Services.
Security practice questions
Practise DVA-C02 questions linked to Security.
Deployment practice questions
Practise DVA-C02 questions linked to Deployment.
Troubleshooting and Optimization practice questions
Practise DVA-C02 questions linked to Troubleshooting and Optimization.
DVA-C02 fundamentals practice questions
Practise DVA-C02 questions linked to DVA-C02 fundamentals.
DVA-C02 scenario practice questions
Practise DVA-C02 questions linked to DVA-C02 scenario.
DVA-C02 troubleshooting practice questions
Practise DVA-C02 questions linked to DVA-C02 troubleshooting.
Practice this exam
Start a free DVA-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this DVA-C02 question test?
Security — This question tests Security — Customer managed KMS key.
What is the correct answer to this question?
The correct answer is: Customer managed KMS key with automatic rotation enabled — Customer managed KMS keys support automatic rotation with a configurable rotation period. You can set the rotation period to 90, 180, or 365 days when enabling automatic rotation. This allows the company to meet the 90-day rotation requirement with minimal operational overhead, as AWS handles the rotation automatically. AWS managed keys and AWS owned keys do not allow custom rotation periods, and manual rotation (option A) requires significant overhead.
What should I do if I get this DVA-C02 question wrong?
Review customer managed KMS key, then practise related DVA-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Customer managed KMS key
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS KMS with customer managed keys to encrypt S3 objects. The security team requires automatic key rotation. What must the developer do to enable rotation?
hard- A.Use AWS managed keys instead of customer managed keys
- B.Rotation is enabled by default for all KMS keys
- ✓ C.Enable automatic key rotation in the KMS key settings
- D.Create a new key and update the alias to point to the new key annually
Why C: For customer managed KMS keys, automatic key rotation can be enabled in the key management console or via the AWS CLI. Option A is incorrect because AWS managed keys rotate automatically, but the requirement specifies customer managed keys. Option B is incorrect because rotation is not enabled by default for customer managed keys; it must be enabled manually. Option D is incorrect because while you could manually rotate by creating a new key and updating the alias, the question asks what must be done to enable rotation, and the simplest and correct method is to enable automatic key rotation in the KMS key settings. Therefore, Option C is correct.
Variation 2. A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that all KMS keys are rotated every year. Which action should be taken?
hard- A.Manually rotate the KMS key every year
- B.Create a new KMS key and update all applications to use it
- ✓ C.Enable automatic key rotation
- D.Use AWS CloudWatch Events to trigger a Lambda function that rotates the key
Why C: AWS KMS supports automatic key rotation for customer-managed KMS keys. When enabled, KMS rotates the key material annually without requiring any manual intervention or application changes. This satisfies the security team's requirement for yearly rotation while maintaining the same key ID and existing encrypted data accessibility.
Variation 3. A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated automatically every year. Which solution meets this requirement with the LEAST operational overhead?
medium- ✓ A.Use an AWS managed key (aws/s3) for S3 encryption.
- B.Use a customer managed key and enable automatic rotation.
- C.Create a customer managed key and rotate it manually every year.
- D.Use an asymmetric KMS key and rotate it automatically.
Why A: Option A is correct because AWS managed keys (aws/s3) are automatically rotated annually by AWS, requiring zero operational overhead. Option B (customer managed key with automatic rotation) also supports automatic rotation but requires enabling it, adding minimal overhead, but AWS managed keys are simpler and have the least overhead. Option C (manual rotation) adds significant overhead. Option D (asymmetric key) is not suitable for S3 encryption and automatic rotation for asymmetric keys is not supported by default.
Keep practising
More DVA-C02 practice questions
- A developer is troubleshooting an AWS Lambda function that is triggered by an S3 event. The function occasionally fails…
- A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use…
- A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role…
- A developer needs to grant an IAM role in Account B read-only access to objects in an S3 bucket in Account A. The bucket…
- An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer t…
- A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permission…
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.