SCS-C02 Data Protection Practice Question
A company needs to encrypt data at rest in its Amazon EBS volumes. The company wants to use an encryption key that is automatically rotated every year without any manual intervention. Which key type should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS managed key for EBS
AWS managed keys are automatically rotated annually. Option B (AWS managed key for EBS) is correct because this key type handles rotation automatically without any manual intervention. Option A (Imported key material in a customer managed key) is incorrect because imported key material does not support automatic rotation. Option C (Customer managed key with manual rotation) is incorrect because even though automatic rotation can be enabled on a customer managed key, the key type itself requires enabling rotation; the question implies a managed solution without manual setup. Option D (Default EBS encryption using an AWS managed key) is incorrect because it refers to an encryption setting, not a key type, and the question asks for the key type.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Imported key material in a customer managed key
Why it's wrong here
Imported key material in a customer managed key cannot be rotated automatically because AWS KMS does not have the original material in a form it can manage; automatic key rotation is disabled for customer managed keys that use imported key material. To rotate, you would have to create a new key and re-import key material, which is a manual operation. Therefore it does not meet an automatic rotation requirement.
- ✓
AWS managed key for EBS
Why this is correct
The AWS managed key for EBS (aws/ebs) is a KMS key that AWS creates and manages in the customer's account, and AWS KMS automatically rotates it once per year. Because EBS volumes can use this key by default and no customer action is required for rotation, it satisfies the requirement for automatic rotation. This is the key type that the question is asking to identify.
- ✗
Customer managed key with manual rotation
Why it's wrong here
A customer managed key with manual rotation puts the responsibility on the customer to create a new KMS key, update the alias to point to the new key, and update any applications or resources that reference the old key. Manual rotation is not an automatic process and does not meet a requirement for automatic key rotation, even though the key is customer managed and otherwise suitable for EBS encryption.
- ✗
Default EBS encryption using an AWS managed key
Why it's wrong here
Default EBS encryption is an account- or Region-level setting that causes new volumes to be encrypted with the AWS managed key aws/ebs, which is automatically rotated. However, it is a configuration option, not a key type; the underlying key type is still an AWS managed key. Because the question asks which KMS key type meets the requirement, describing the default setting is not the correct answer even though it uses a valid, automatically rotated key.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.