SCS-C02 Data Protection Practice Question
Network Topology
A security engineer examines the above output. The company requires automatic yearly key rotation. What should the engineer do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab'
The key is a customer managed CMK (KeyRotationEnabled: false indicates it's not an AWS managed key, as AWS managed keys have rotation enabled automatically and cannot be disabled). Enabling automatic rotation on a customer managed CMK is done via the 'aws kms enable-key-rotation' CLI command. Option B is incorrect because AWS CloudHSM is not required for key rotation; automatic rotation can be enabled directly on the CMK without manual intervention. Option C is incorrect because replacing the key with an AWS managed key would remove control over rotation and is not a necessary action; the current key can have rotation enabled. Option D is incorrect because if key material is imported, automatic rotation is not supported; the key must be rotated manually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab'
Why this is correct
This enables automatic yearly rotation for a customer managed key.
- ✗
Use AWS CloudHSM to generate a new key and rotate manually.
Why it's wrong here
CloudHSM requires manual rotation.
- ✗
Replace the key with an AWS managed key.
Why it's wrong here
AWS managed keys rotate automatically, but the engineer may not want to replace the key.
- ✗
Import a key material and enable automatic rotation.
Why it's wrong here
Imported key material does not support automatic rotation.
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.