CCSP Cloud Data Security Practice Question
A company uses a cloud KMS service with an HSM backing for key storage. The security policy requires that keys be rotated automatically every 90 days and that old keys be retained for at least one year to decrypt archived data. Which key management feature should be configured to meet these requirements?
⚠ Common exam trap
CCSP often tests the difference between key rotation, key versioning, and key policies, and candidates may choose key policies or key hierarchy thinking they enable automatic rotation, when in fact versioning with a rotation schedule is the specific feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key versioning with rotation schedule
Key versioning with a rotation schedule allows the KMS to automatically rotate keys every 90 days while retaining old key versions for decryption of archived data. Each rotation creates a new key version, and old versions remain available for decryption but are not used for new encryption. This meets both the rotation and retention requirements without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Key hierarchy with root key separation
Why it's wrong here
Root key separation structures keys into hierarchies for wrapping and isolation; it does not schedule rotation or retain retired key versions for decryption. It is tempting because hierarchy design underpins KMS key management, and would be correct where the requirement is limiting exposure of top-level keys rather than automated rotation with retention.
- ✓
Key versioning with rotation schedule
Why this is correct
Key versioning retains prior key versions alongside the current one, so scheduled rotation every 90 days generates new versions while old versions persist to decrypt archived data. This satisfies both the 90-day automatic rotation and one-year retention constraints simultaneously.
- ✗
Key policy with conditions for automatic rotation
Why it's wrong here
A key policy with rotation conditions governs permissions and lifecycle triggers, but it does not itself perform scheduled rotation or retain superseded key versions for decryption. It is tempting because policies define rotation eligibility; the correct feature is automatic rotation with version retention, which actually rotates every 90 days and keeps old versions usable.
- ✗
Key import with manual rotation
Why it's wrong here
Importing key material places rotation responsibility on the customer, so no automatic 90-day cycle occurs, and imported keys typically lack managed version retention for archived data. Import suits bring-your-own-key scenarios requiring externally generated material, not policy-driven scheduled rotation with retained old versions.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.