easyMultiple ChoiceObjective-mapped
CCSP Practice Question: Uses a cloud key management service (KMS) for…
An organization uses a cloud key management service (KMS) for encryption keys. The security policy requires automatic rotation of keys every 90 days. Which rotation strategy best balances security and operational impact?
⚠ Common exam trap
It's easy for candidates to confuse key rotation with re-encryption, assuming that rotating a key requires re-encrypting all existing data, when in fact cloud KMS versioning allows old keys to remain available for decryption without re-encrypting the entire dataset.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the KMS to automatically generate new key versions and retire old ones with no application changes.
Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) support automatic key rotation by creating new key versions while retaining previous versions for decryption of existing data. This approach satisfies the 90-day rotation policy without requiring application changes, as the KMS handles versioning transparently and the encryption context or key ID abstraction allows seamless use of the latest key for encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retain the original key for decryption and use a new key only for new data.
Why it's wrong here
This defeats the purpose of rotation as old data remains encrypted with old key.
- ✗
Have administrators manually create new keys every 90 days and update applications.
Why it's wrong here
Manual rotation is error-prone and increases operational overhead.
- ✓
Configure the KMS to automatically generate new key versions and retire old ones with no application changes.
Why this is correct
Automatic rotation with versioning is seamless and secure.
- ✗
Re-encrypt all data with a new master key each rotation to ensure full key separation.
Why it's wrong here
Re-encrypting all data is resource-intensive and often unnecessary.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.