DOP-C02 Security and Compliance Practice Question
An organization uses AWS Key Management Service (KMS) with customer-managed keys. The security policy requires automatic key rotation every year. A DevOps engineer notices that the key material is not rotating as expected. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The key was created by importing key material; automatic rotation is not supported for imported keys.
Automatic key rotation is not supported for imported key material. Option B is wrong because KMS does not charge extra for automatic rotation. Option C is wrong because KMS does not require re-importing for rotation; it's simply not available. Option D is wrong because the key state does not prevent rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The key was created by importing key material; automatic rotation is not supported for imported keys.
Why this is correct
An AWS KMS customer master key with imported key material (Origin: EXTERNAL) cannot have automatic key rotation enabled, because rotation relies on the key material being generated and managed within AWS KMS. The import mechanism bypasses KMS's managed backing keys, so the service cannot automatically replace the backing key. To rotate such a key, you must manually create a new CMK or import new key material into the existing CMK.
- ✗
The key must be re-imported annually to enable rotation.
Why it's wrong here
Simply re-importing key material on an annual basis does not enable automatic rotation, nor is it required. Automatic rotation is a property of the CMK that AWS KMS only allows when the key material was originally created inside AWS KMS (Origin: AWS_KMS). Re-importing new material updates the backing key but does not change the CMK's origin, so the automatic rotation option remains unsupported indefinitely.
- ✗
The key is not enabled for rotation due to a billing limit.
Why it's wrong here
There is no billing limit that prevents KMS key rotation; automatic rotation is available on all customer managed CMKs with AWS_KMS origin at no additional per-rotation charge (only normal API request charges apply). If the rotation toggle is unavailable, it is due to the key material's origin, not any account or billing restriction. AWS Trusted Advisor might show service limits, but none affect this feature.
- ✗
The key is in a 'Pending Deletion' state and cannot be rotated.
Why it's wrong here
A CMK in the 'Pending Deletion' state is scheduled for deletion and is not available for cryptographic operations, but that is a separate condition and does not explain an inability to enable rotation. You can cancel key deletion at any time during the waiting period; after cancellation, you could enable automatic rotation if the key material were AWS-generated. Since the correct reason is that the key was created with imported key material, the pending deletion state is not the underlying blocker.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.