AWS KMS Key Management Best Practices
Which THREE practices are recommended for managing encryption keys in AWS KMS? (Choose 3.)
Quick Answer
The recommended practices for managing encryption keys in AWS KMS are enabling automatic annual key rotation, using key policies to enforce least privilege access, and enabling AWS CloudTrail logging to record KMS API calls. These three actions work together to ensure cryptographic hygiene: rotation limits the impact of a compromised key, key policies provide granular, resource-based access control, and CloudTrail delivers an immutable audit trail for every key usage event. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of operational security controls versus common pitfalls—the trap is confusing key material sharing or immediate deletion with proper management. Remember that KMS never exposes key material, and deletion must always be scheduled with a waiting period to prevent irreversible data loss. A useful memory trick is “Rotate, Restrict, Record”—if you rotate keys annually, restrict access with policies, and record all API calls, you cover the three core pillars of KMS best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic rotation of the KMS key annually.
Options B, D, and E are correct. B: Enabling automatic key rotation annually is a best practice to ensure keys are rotated regularly without manual intervention. D: Using key policies to restrict which IAM roles can use the key follows the principle of least privilege. E: Enabling AWS CloudTrail logging to record KMS key usage provides an audit trail for security monitoring. Option A is incorrect because deleting a KMS key immediately can cause permanent data loss; instead, you should schedule key deletion. Option C is incorrect because exporting KMS key material and storing it in an S3 bucket would expose the key material and defeat the purpose of using a managed service like KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the KMS key immediately when it is no longer needed.
Why it's wrong here
Deletion should be scheduled to avoid data loss.
- ✓
Enable automatic rotation of the KMS key annually.
Why this is correct
Rotation helps meet compliance requirements.
- ✗
Export the KMS key material and store it in a secure S3 bucket.
Why it's wrong here
Exporting key material bypasses KMS security.
- ✓
Use key policies to restrict which IAM roles can use the key.
Why this is correct
Key policies are a primary access control mechanism.
- ✓
Enable AWS CloudTrail logging to record KMS key usage.
Why this is correct
Auditing is essential for security.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are valid key management features of AWS KMS? (Choose THREE.)
hard- ✓ A.Importing key material
- ✓ B.Key policies
- C.SSL certificate management
- D.Password generation
- ✓ E.Automatic key rotation
Why A: AWS KMS allows you to import your own key material (BYOK) for use with KMS keys, which is a valid key management feature. This is done via the 'ImportKeyMaterial' API, enabling you to create a KMS key with no key material and then upload your own symmetric key material. This feature is essential for meeting compliance requirements that mandate control over the key material lifecycle.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.