SCS-C03 Data Protection Practice Question
An organization wants to rotate their KMS customer-managed keys every 90 days. What is the most effective way to implement this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform manual key rotation by creating a new key every 90 days.
AWS KMS automatic rotation occurs every 365 days and cannot be configured for a 90-day interval. To meet a 90-day requirement, the organization must perform manual rotation. This involves creating a new key, updating the application's key ID configuration (or using an alias), and keeping the old key active only for decrypting existing data, which is a standard procedure for strict compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the KMS key's rotation policy to 90 days.
Why it's wrong here
The rotation interval for AWS KMS is fixed at 365 days. Users cannot change this setting in the AWS console or via API. Attempting to do so will result in an error, as the system does not support custom intervals for the automated rotation feature.
- ✗
Use an AWS Lambda function to trigger the rotation of the KMS key backing material.
Why it's wrong here
You cannot trigger the rotation of the backing key material for an existing KMS key. Rotation is an internal AWS KMS service process. To achieve a 90-day rotation, you must manually create a new key and migrate your services to use the new key, rather than modifying existing keys.
- ✓
Perform manual key rotation by creating a new key every 90 days.
Why this is correct
Since automatic rotation is fixed at 365 days, manual rotation is the only way to satisfy a 90-day requirement. This involves creating a new KMS key, updating application references, and retaining the previous key for decryption of legacy data, ensuring compliance with internal security policies.
- ✗
Use AWS Secrets Manager to rotate the KMS key every 90 days.
Why it's wrong here
Secrets Manager rotates credentials like database passwords, not KMS keys. KMS keys are handled by the KMS service itself. Attempting to use Secrets Manager for this task is a misunderstanding of the service boundaries and responsibilities between Secrets Manager and AWS KMS.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.