DOP-C02 Security and Compliance Practice Question
A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which KMS key type should the company use to meet this requirement without manual intervention?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Customer managed key
AWS managed keys (AWS managed key) are automatically rotated every three years, not every year. Customer managed keys (Customer managed key) can be configured for automatic annual rotation. Imported key material cannot be automatically rotated. A Custom key store does not support automatic rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Customer managed key
Why this is correct
Customer managed keys support enabling automatic key rotation with a default schedule of once per year. When enabled, KMS generates new backing key material each rotation while preserving the same key ID and previous material for decryption, allowing transparent annual rotation. This directly satisfies the stated requirement for annual key rotation.
- ✗
Imported key material
Why it's wrong here
When you import key material into a KMS key, automatic rotation is not supported because KMS cannot generate replacement key material for keys whose material you supply. You can only rotate manually by creating a new customer managed key with fresh imported material and updating aliases or applications, which does not meet an annual automatic rotation requirement. This option is incorrect because the required automated annual process is impossible with imported key material.
- ✗
Custom key store (CloudHSM)
Why it's wrong here
Keys in a CloudHSM custom key store use key material stored in your own CloudHSM cluster, and KMS cannot automatically rotate such key material. Although manual rotation via creating a new key is possible, the custom key store lacks the KMS-managed automatic rotation capability because the HSMs control the key generation lifecycle. Therefore, this type cannot fulfill an annual automatic rotation policy.
- ✗
AWS managed key
Why it's wrong here
AWS managed keys are automatically rotated by AWS, but only on a three-year cadence rather than annually. Additionally, you have no ability to alter or enable a different rotation frequency for AWS managed keys because their rotation is controlled entirely by AWS. Since the requirement specifies annual rotation, an AWS managed key does not satisfy it.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?
hard- A.AWS owned key
- B.Custom key store backed by CloudHSM
- ✓ C.Customer managed key (CMK)
- D.AWS managed key (aws/s3)
Why C: AWS managed keys (aws/s3) are automatically rotated every year (365 days). Customer managed keys allow you to set a custom rotation period (any length between 90 days and 10 years) but require enabling rotation. The key is that aws/s3 keys rotate automatically without any configuration. However, the question says 'all encryption keys' and 'every 365 days' - both options can achieve that, but aws/s3 keys are automatically rotated, while customer managed keys need rotation enabled. The best practice is to use the most appropriate. But note: customer managed keys can be rotated automatically if you enable it. The question might be ambiguous, but typical exam scenario: use customer managed keys for more control. However, the security team requires automatic rotation; both can do it. The nuance: customer managed keys have a rotation period that you can set, but the default is 365 days when you enable rotation. So both work. But the question says 'which type' - likely they want customer managed because it allows you to control the policy. However, aws/s3 keys are automatically rotated and cannot be customized. Since the requirement is 'every 365 days', which is the default for both, but aws/s3 keys are already rotated on that schedule. I think the answer is 'Customer managed key' because it's a key you own and have control over the rotation policy. Actually, aws/s3 keys are rotated annually, but you cannot view or manage them. For compliance, you might need to control the key. So I'll go with customer managed key.
Variation 2. A company is using AWS KMS to encrypt data at rest in Amazon S3. The Security team requires that all encryption keys be automatically rotated annually. Which key type should be used to meet this requirement?
medium- A.Asymmetric KMS key
- ✓ B.AWS managed symmetric key
- C.Customer managed symmetric key
- D.Custom key store backed by AWS CloudHSM
Why B: AWS managed KMS keys (AWS managed keys) are automatically rotated every year. Customer managed keys require manual rotation or key rotation configuration. AWS managed keys are used for services like S3, EBS, and RDS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.