Study. uk . com
  1. Home
  2. All questions
  3. Question 106

AWS Certified Solutions Architect study material · question 106 of 500

Which two statements about on-demand rotation of a KMS key are correct? Choose two.

  1. It re-encrypts all data protected by the key
  2. It replaces the key with a new key ARN
  3. It can be run whether or not automatic rotation is enabled
  4. It leaves any existing automatic rotation schedule unchanged
Show the answer

Answer: C. It can be run whether or not automatic rotation is enabled
D. It leaves any existing automatic rotation schedule unchanged

On-demand rotation is available at any time and does not disturb the automatic schedule; it also does not re-encrypt data or change the key.

Source: Rotate AWS KMS keys (Amazon Web Services) — Rotate AWS KMS keys

Challenge yourself on this topic → Study as cards