mediumMultiple SelectObjective-mapped
CCSP Practice Question: A company uses a cloud key management service…
A company uses a cloud key management service (KMS) with automatic key rotation enabled. Which TWO statements about key rotation are true?
⚠ Common exam trap
ISC2 often tests the misconception that key rotation changes the key identifier or requires immediate re-encryption, when in fact the key ID remains stable and old key material is preserved for decryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
New key material is generated, and the old key material is retained for decryption.
Cloud KMS services (e.g., AWS KMS, Azure Key Vault) implement automatic key rotation by generating new cryptographic key material while retaining the old key material. This allows data encrypted with the previous key version to still be decrypted, as the old key material is not destroyed but simply marked as retired for encryption operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The key ID changes after each rotation.
Why it's wrong here
Incorrect: The key ID typically remains the same; only the key material is rotated.
- ✗
The old key is immediately destroyed after rotation.
Why it's wrong here
Incorrect: The old key is retained to decrypt previously encrypted data.
- ✓
New key material is generated, and the old key material is retained for decryption.
Why this is correct
Correct: Automatic rotation creates a new version; the old version is kept for decryption.
- ✓
Applications using the key continue to work without modification.
Why this is correct
Correct: Automatic rotation is transparent to applications.
- ✗
All data encrypted with the old key must be re-encrypted.
Why it's wrong here
Incorrect: Re-encryption is not required; the system uses the appropriate key version.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.