← SCS-C02·Amazon Web Services

Question 1,061 of 1,748

Data Protection →mediumMultiple ChoiceObjective-mapped

Enable Automatic KMS Key Rotation

This SCS-C02 practice question tests your understanding of data protection. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: aWS KMS automatic key rotation. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which action should be taken?

A
Enable automatic key rotation on the customer managed key.
Automatic rotation can be enabled on customer managed keys to rotate yearly.
B
Create a new key and update the alias to point to the new key every year.
Why wrong: Manual rotation is possible but not the simplest approach; automatic rotation is preferred.
C
Enable automatic key rotation on the AWS managed key.
Why wrong: AWS managed keys rotate automatically every three years, but cannot be configured for yearly rotation.
D
Use an AWS CloudTrail event to trigger a Lambda function that rotates the key.
Why wrong: Overly complex; automatic rotation is the recommended method.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable automatic key rotation on the customer managed key.

Option A is correct because AWS KMS supports enabling automatic key rotation for customer managed keys (CMKs), which rotates the key material annually without manual intervention. Option B is incorrect because manually rotating keys by creating a new key and updating aliases is unnecessary when automatic rotation can be enabled. Option C is incorrect because AWS managed keys are automatically rotated by AWS approximately every three years, but the customer cannot configure this rotation. Option D is incorrect because CloudTrail logs API calls but does not perform key rotation; using Lambda for rotation adds unnecessary complexity.

Key principle: AWS KMS automatic key rotation

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable automatic key rotation on the customer managed key.
Why this is correct
Automatic rotation can be enabled on customer managed keys to rotate yearly.
Related concept
AWS KMS automatic key rotation
✗
Create a new key and update the alias to point to the new key every year.
Why it's wrong here
Manual rotation is possible but not the simplest approach; automatic rotation is preferred.
✗
Enable automatic key rotation on the AWS managed key.
Why it's wrong here
AWS managed keys rotate automatically every three years, but cannot be configured for yearly rotation.
✗
Use an AWS CloudTrail event to trigger a Lambda function that rotates the key.
Why it's wrong here
Overly complex; automatic rotation is the recommended method.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.

Detailed technical explanation

How to think about this question

Treat this as a scenario question. Identify the problem, the constraint, and the best action. Then compare each option against those facts.

KKey Concepts to Remember

AWS KMS automatic key rotation
Customer managed keys (CMKs)
AWS managed keys

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

AWS KMS automatic key rotation

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

What to study next

Got this wrong? Here's your next step.

Review aWS KMS automatic key rotation, then practise related SCS-C02 questions on the same topic to reinforce the concept.

Related SCS-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Threat Detection and Incident Response practice questions

Practise SCS-C02 questions linked to Threat Detection and Incident Response.

Security Logging and Monitoring practice questions

Practise SCS-C02 questions linked to Security Logging and Monitoring.

Identity and Access Management practice questions

Practise SCS-C02 questions linked to Identity and Access Management.

Management and Security Governance practice questions

Practise SCS-C02 questions linked to Management and Security Governance.

Infrastructure Security practice questions

Practise SCS-C02 questions linked to Infrastructure Security.

Data Protection practice questions

Practise SCS-C02 questions linked to Data Protection.

SCS-C02 fundamentals practice questions

Practise SCS-C02 questions linked to SCS-C02 fundamentals.

SCS-C02 scenario practice questions

Practise SCS-C02 questions linked to SCS-C02 scenario.

SCS-C02 troubleshooting practice questions

Practise SCS-C02 questions linked to SCS-C02 troubleshooting.

Practice this exam

Start a free SCS-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SCS-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SCS-C02 question test?

Data Protection — This question tests Data Protection — AWS KMS automatic key rotation.

What is the correct answer to this question?

The correct answer is: Enable automatic key rotation on the customer managed key. — Option A is correct because AWS KMS supports enabling automatic key rotation for customer managed keys (CMKs), which rotates the key material annually without manual intervention. Option B is incorrect because manually rotating keys by creating a new key and updating aliases is unnecessary when automatic rotation can be enabled. Option C is incorrect because AWS managed keys are automatically rotated by AWS approximately every three years, but the customer cannot configure this rotation. Option D is incorrect because CloudTrail logs API calls but does not perform key rotation; using Lambda for rotation adds unnecessary complexity.

What should I do if I get this SCS-C02 question wrong?

Review aWS KMS automatic key rotation, then practise related SCS-C02 questions on the same topic to reinforce the concept.

What is the key concept behind this question?

AWS KMS automatic key rotation

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on SCS-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. However, the current KMS key policy does not allow rotation. Which action should the security team take to meet the requirement?

medium

A.Manually rotate the key by creating a new key and updating the S3 bucket policy.
✓ B.Use an AWS managed key instead of a customer managed key.
C.Create a new customer managed key with imported key material and enable automatic rotation.
D.Enable automatic rotation on the existing customer managed key.

Why B: Option B is correct because AWS managed keys are automatically rotated annually by AWS. This meets the requirement without needing to modify the existing key policy. Option A is wrong because manually rotating the key by creating a new key and updating the S3 bucket policy does not provide automatic rotation and is not the simplest solution. Option C is wrong because customer managed keys with imported key material do not support automatic rotation. Option D is wrong because the existing key policy does not allow rotation, so enabling automatic rotation on that key would fail; the correct approach is to use an AWS managed key.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.