SCS-C02 Data Protection Practice Question
A financial services company uses AWS KMS to encrypt sensitive data. The security team has a requirement to rotate the CMK every 90 days and to maintain a record of all previous key versions for decryption of historical data. The team creates a new CMK every 90 days and manually updates applications to use the new key. This process is error-prone and causes downtime. What is the MOST operationally efficient solution that meets the requirements?
⚠ Common exam trap
Many candidates confuse automatic key rotation (which only rotates backing keys within the same CMK) with creating a new CMK and using aliases, failing to recognize that automatic rotation does not meet a 90-day schedule and does not create a separate CMK for audit or compliance purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.
It uses aliases to decouple the key identifier from the application configuration. By creating a new CMK every 90 days and updating the alias to point to the new key, applications that reference the alias automatically use the new key without code changes, eliminating downtime. AWS KMS aliases are mutable pointers that can be reassigned to different CMKs, and the old key versions remain available for decryption of historical data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable automatic key rotation on the existing CMK.
Why it's wrong here
Enabling automatic rotation on the existing CMK does not satisfy the 90-day rotation requirement because AWS KMS automatic rotation is traditionally based on a 365-day schedule in the context of this exam; it cannot be set to a 90-day cadence. Additionally, automatic rotation keeps the same key ID and only generates new backing key material, so it does not provide a new key identity as required by many compliance frameworks. Therefore, this option fails to meet the mandatory rotation period and is incorrect.
- ✓
Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.
Why this is correct
Creating a new CMK every 90 days and then updating the alias to reference the new key provides a stable abstraction because applications point to the alias, not the key ID. The alias update is immediate and atomic, requiring no application changes, restarts, or downtime; the old CMK remains enabled to decrypt data encrypted under previous keys. This pattern is the recommended AWS KMS approach for custom rotation periods and satisfies crypto-period separation.
- ✗
Use a CMK with imported key material and rotate the material every 90 days.
Why it's wrong here
Manually importing new key material every 90 days fails to automate the rotation process and requires manual intervention, which does not resolve the downtime caused by updating application configurations. This approach is intended for scenarios where you must maintain control over key generation outside of AWS or comply with specific regulatory requirements necessitating external entropy. It becomes the correct choice when a company must use keys generated within an on-premises Hardware Security Module (HSM).
- ✗
Continue creating new CMKs but use a script to update the application configuration files.
Why it's wrong here
While creating new CMKs each 90 days is directionally correct, using a script to update application configuration files with the new key ID introduces manual-like intervention and downtime risks. Applications must be redeployed or restarted to load the new key ID, and script failures can cause encryption operations to target a key the application cannot access or that is no longer the intended one. This approach also duplicates alias indirection per application instead of centralizing the pointer, making it operationally fragile and not a best practice.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.