AWS Certified Solutions Architect Data Encryption with KMS 3 — Questions and Answers
Question 1: A company operates in multiple AWS Regions and needs the same KMS key material available in all regions for consistent encryption. What is the correct AWS KMS feature to use?
- Copy the CMK ARN across regions using IAM
- Use KMS multi-Region keys (Correct answer)
- Share the key via AWS Resource Access Manager
- Export key material and re-import in each region
Correct answer: Use KMS multi-Region keys
KMS multi-Region keys are a set of interoperable keys with identical key material and key IDs that can be used independently in multiple AWS Regions.
Question 2: An EBS volume is encrypted with KMS key A. A snapshot is taken and shared with another AWS account. What must be done so the other account can create an encrypted volume from the snapshot?
- Nothing; snapshot sharing automatically grants KMS access
- Grant the other account kms:DescribeKey and kms:CreateGrant on key A, or re-encrypt the snapshot with a key the other account owns (Correct answer)
- The other account must use SSE-S3 instead
- Disable encryption on the snapshot before sharing
Correct answer: Grant the other account kms:DescribeKey and kms:CreateGrant on key A, or re-encrypt the snapshot with a key the other account owns
Cross-account snapshot sharing requires that the receiving account has KMS key permissions to use the source key, or the snapshot must be re-encrypted with a key the receiving account controls.
Question 3: Which KMS key rotation policy is automatically applied to AWS managed keys (e.g., aws/s3)?
- No rotation; AWS managed keys never rotate
- Annual automatic rotation every 365 days (Correct answer)
- Rotation every 90 days
- Rotation only when explicitly triggered via API
Correct answer: Annual automatic rotation every 365 days
AWS managed keys rotate automatically every year (365 days), and this behavior cannot be disabled by customers.
Question 4: A developer calls kms:GenerateDataKeyWithoutPlaintext. What does this API return compared to kms:GenerateDataKey?
- Both plaintext and encrypted data key, same as GenerateDataKey
- Only the encrypted data key, without the plaintext version (Correct answer)
- Only the plaintext data key for immediate use
- A reference ARN to retrieve the key later
Correct answer: Only the encrypted data key, without the plaintext version
GenerateDataKeyWithoutPlaintext returns only the encrypted data key, which is useful when you want to store the encrypted key for later decryption without ever exposing the plaintext.
Question 5: A KMS key policy does not explicitly allow the AWS account root user. What is the effect on IAM policies for that key?
- IAM policies can still grant full access to all IAM principals
- IAM policies have no effect; only the key policy controls access (Correct answer)
- The key is automatically disabled until the root is added
- AWS Support must manually restore access
Correct answer: IAM policies have no effect; only the key policy controls access
If the key policy does not grant the account root access, IAM policies cannot override the key policy, potentially locking everyone out of the key.
Question 6: A company wants to use AWS CloudTrail to audit every use of a KMS key. Which CloudTrail event source should they monitor?
- s3.amazonaws.com
- kms.amazonaws.com (Correct answer)
- iam.amazonaws.com
- cloudtrail.amazonaws.com
Correct answer: kms.amazonaws.com
All KMS API calls, including Encrypt, Decrypt, and GenerateDataKey, are logged by CloudTrail under the kms.amazonaws.com event source.
Question 7: What is the minimum waiting period before AWS permanently deletes a KMS key after scheduling its deletion?
- 1 day
- 7 days (Correct answer)
- 30 days
- 90 days
Correct answer: 7 days
The minimum key deletion waiting period is 7 days (default is 30 days), during which you can cancel the deletion if the key is still needed.
AWS Certified Solutions Architect Data Encryption with KMS 3
A company operates in multiple AWS Regions and needs the same KMS key material available in all regions for consistent encryption.
What is the correct AWS KMS feature to use?