Study. uk . com
  1. Home
  2. All questions
  3. Question 25

AWS Certified Solutions Architect study material · question 25 of 500

An auditor needs CloudTrail evidence of every use of the key protecting a data set. Which KMS key type makes that impossible?

  1. A customer managed key
  2. An AWS managed key
  3. A customer managed key with rotation enabled
  4. An AWS owned key
Show the answer

Answer: D. An AWS owned key

Activity on an AWS owned key is hidden from the customer; customer managed and AWS managed keys both appear in the account's CloudTrail.

Source: AWS KMS keys (Amazon Web Services) — AWS KMS keys — comparison table

Challenge yourself on this topic → Study as cards