A cloud backup service uses envelope encryption. The key-encryption key is nearing the end of its approved lifetime, but the business cannot decrypt and re-encrypt every backup object this week. Which two statements best describe the correct rotation approach? Select two.

Decrypt and re-encrypt every backup object immediately with a new data key.

That approach is unnecessary here and would create a much larger operational burden than required.

Destroy the old key before the rewrapping process finishes.

Deleting the old key too early would prevent access to data that still depends on it during transition.

Replace the hashing algorithm used for file integrity checks.

Hashing and key rotation are separate concerns, so changing the hash algorithm does not rotate encryption keys.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Generate a new key-encryption key and use it for future backups. — With envelope encryption, the key-encryption key can be rotated without decrypting every protected object. The correct process is to generate a new KEK for future backups and rewrap the existing data-encryption keys under the new KEK. That preserves access to the encrypted backup data while meeting the key-lifecycle requirement. This is far more efficient than re-encrypting all backup objects and is the standard operational advantage of envelope encryption. Why others are wrong: Re-encrypting every object is unnecessary when only the wrapping key changes, and it creates avoidable downtime and processing overhead. Destroying the old key too soon would break access to data that has not yet been rewrapped. Hash algorithm changes are unrelated to key rotation and would not satisfy the requirement to retire the KEK on schedule.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.