hardMultiple ChoiceObjective-mapped
CCSP Practice Question: Uses a cloud key management service (KMS) to…
An organization uses a cloud key management service (KMS) to encrypt data at rest. The security policy requires that the encryption keys be rotated every 90 days. The operations team is concerned about the impact of key rotation on encrypted data. Which of the following statements is true regarding KMS key rotation?
⚠ Common exam trap
ISC2 often tests the misconception that key rotation forces re-encryption of all existing data, but the correct understanding is that previous key versions remain available for decryption, making re-encryption optional unless the old key is deleted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data encrypted before rotation can still be decrypted using the previous key as long as it is available
Cloud KMS retains previous key versions after rotation, allowing decryption of data encrypted with older keys. The key rotation creates a new cryptographic key version, but the old version remains active for decryption until it is disabled or deleted. This ensures that data encrypted before rotation remains accessible without re-encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Key rotation is not supported in cloud KMS
Why it's wrong here
Cloud KMS supports key rotation.
- ✓
Data encrypted before rotation can still be decrypted using the previous key as long as it is available
Why this is correct
KMS retains previous keys to decrypt older data.
- ✗
The KMS automatically re-encrypts all data with the new key
Why it's wrong here
KMS does not re-encrypt data; it only manages keys.
- ✗
Existing data encrypted with the previous key must be re-encrypted with the new key
Why it's wrong here
Re-encryption is not needed; old keys remain available for decryption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.