KMS for key management in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when you disable a KMS key?

You have an AWS KMS key that you disable. What is the immediate effect on services using this key?

A The key automatically rotates to a new key version.

B Services can still encrypt and decrypt data with the key without interruption.

C The key is deleted permanently and cannot be recovered.

D Services can no longer use the key to encrypt or decrypt data until it is enabled again.

💡 Hint

Think about what disabling a key means for its usability.

Disabling a KMS key prevents any encryption or decryption operations using that key. It does not delete the key or rotate it automatically.

❓ security

intermediate

Which IAM policy action allows decrypting data with a KMS key?

You want to allow a user to decrypt data encrypted with a specific KMS key. Which IAM action must be included in the policy?

A kms:Decrypt

B kms:Encrypt

C kms:GenerateDataKey

D kms:CreateKey

💡 Hint

Decrypting data requires a specific permission related to reading encrypted content.

The kms:Decrypt action allows a user to decrypt ciphertext that was encrypted under a KMS key.

❓ Architecture

advanced

How to architect secure key rotation with AWS KMS?

You want to ensure your encryption keys rotate automatically without downtime for your application. Which approach is best?

A Enable automatic key rotation on the KMS customer managed key and use the same key ARN in your application.

B Manually create new keys and update your application to use the new key ARN each time.

C Delete old keys after creating new ones to avoid confusion.

D Use AWS Secrets Manager to store keys and rotate them manually.

💡 Hint

Think about how KMS supports key rotation natively.

Enabling automatic key rotation on a customer managed key allows KMS to create new cryptographic material yearly while keeping the same key ARN, so applications do not need changes.

✅ Best Practice

advanced

What is the best practice for granting least privilege access to KMS keys?

You want to follow the principle of least privilege when granting access to KMS keys. Which practice aligns best?

A Use root account credentials to manage all keys centrally.

B Grant all users full access to all KMS keys to avoid permission errors.

C Use key policies and IAM policies to restrict access to only necessary actions and resources.

D Disable key policies and rely only on IAM policies for access control.

💡 Hint

Think about combining policies to limit access effectively.

Using both key policies and IAM policies to restrict access to only required actions and keys follows least privilege and improves security.

🧠 Conceptual

expert

What error occurs if you try to decrypt data with a KMS key that is scheduled for deletion?

You attempt to decrypt ciphertext using a KMS key that is scheduled for deletion but not yet deleted. What error will AWS KMS return?

A KeyUnavailableException

B KMSInvalidStateException

C AccessDeniedException

D InvalidCiphertextException

💡 Hint

Consider the key's state when scheduled for deletion.

A KMS key scheduled for deletion is in a pending deletion state and cannot be used for cryptographic operations, causing a KMSInvalidStateException error.