AWS Certified Solutions Architect Data Encryption with KMS 3

Question 1

A company operates in multiple AWS Regions and needs the same KMS key material available in all regions for consistent encryption. What is the correct AWS KMS feature to use?

Accepted Answer

Use KMS multi-Region keys

Answer

KMS multi-Region keys are a set of interoperable keys with identical key material and key IDs that can be used independently in multiple AWS Regions.

Question 2

An EBS volume is encrypted with KMS key A. A snapshot is taken and shared with another AWS account. What must be done so the other account can create an encrypted volume from the snapshot?

Accepted Answer

Grant the other account kms:DescribeKey and kms:CreateGrant on key A, or re-encrypt the snapshot with a key the other account owns

Answer

Cross-account snapshot sharing requires that the receiving account has KMS key permissions to use the source key, or the snapshot must be re-encrypted with a key the receiving account controls.

Question 3

Which KMS key rotation policy is automatically applied to AWS managed keys (e.g., aws/s3)?

Accepted Answer

Annual automatic rotation every 365 days

Answer

AWS managed keys rotate automatically every year (365 days), and this behavior cannot be disabled by customers.

Question 4

A developer calls kms:GenerateDataKeyWithoutPlaintext. What does this API return compared to kms:GenerateDataKey?

Accepted Answer

Only the encrypted data key, without the plaintext version

Answer

GenerateDataKeyWithoutPlaintext returns only the encrypted data key, which is useful when you want to store the encrypted key for later decryption without ever exposing the plaintext.

Question 5

A KMS key policy does not explicitly allow the AWS account root user. What is the effect on IAM policies for that key?

Accepted Answer

IAM policies have no effect; only the key policy controls access

Answer

If the key policy does not grant the account root access, IAM policies cannot override the key policy, potentially locking everyone out of the key.

AWS Practice Test

AWS Practice Test

AWS Certified Solutions Architect Data Encryption with KMS 3