DOP-C02 Security and Compliance Practice Question
Which THREE are features of AWS Key Management Service (KMS) that help with compliance requirements? (Choose 3)
⚠ Common exam trap
A common mix-up: candidates confuse KMS key rotation with the automatic deletion or expiry of keys, or they mistakenly associate KMS with password generation features that belong to other AWS services like Secrets Manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatic key rotation every year (optional).
AWS KMS supports optional automatic annual key rotation for customer managed keys. This helps meet compliance frameworks (e.g., PCI DSS, SOC, HIPAA) that require periodic cryptographic key rotation to limit the amount of data encrypted under a single key. When enabled, KMS automatically rotates the key material once per year, creating a new backing key while retaining the old one for decryption of previously encrypted data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Automatic password generation for databases.
Why it's wrong here
KMS is a key management service that creates and controls customer master keys (CMKs) used for encrypting data; it does not generate or manage database passwords. Password generation and rotation for databases is a feature of AWS Secrets Manager, not KMS. Therefore, this option is incorrect.
- ✓
Automatic key rotation every year (optional).
Why this is correct
KMS offers optional automatic rotation of customer-managed keys on an annual basis. When enabled, KMS generates new backing key material each year while preserving the old material so that previously encrypted data can still be decrypted. This feature helps meet compliance requirements for cryptographic key lifecycle management.
- ✓
Key policies to control access to keys.
Why this is correct
Key policies are resource-based policies attached to a KMS key that define which principals can use the key and which actions they can perform. They are the primary authorization mechanism for KMS and can be combined with IAM policies to enforce fine-grained access control. This is essential for ensuring only authorized users and services can encrypt or decrypt data.
- ✓
Integration with AWS CloudTrail for auditing key usage.
Why this is correct
KMS integrates with AWS CloudTrail to record all KMS API operations, including data-plane calls such as Encrypt, Decrypt, and GenerateDataKey. These logs capture the key ID, the requester's IAM identity, and the source IP, providing a complete audit trail for compliance investigations. The audit trail is a critical component for satisfying regulatory requirements.
- ✗
Automatic deletion of keys after a specified period.
Why it's wrong here
KMS does not provide a feature to automatically delete keys after a specified time period. Instead, key deletion is a manual process that requires you to schedule deletion, which is then subject to a mandatory waiting period before the key is permanently removed. This waiting period protects against accidental data loss, but no automated schedule is available.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.