A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK. What should the Security Engineer do to restore the deleted key material?
A.
Create a new CMK. Download a new wrapping key and a new import token to import the original key material.
B.
Create a new CMK. Use the original wrapping key and import token to import the original key material.
C.
Download a new wrapping key and a new import token. Import the original key material into the existing CMK.
D.
Use the original wrapping key and import token. Import the original key material into the existing CMK.
C.
The original wrapping key and import token expires after 24 hours. The question doesn't give us a timeframe, so we should assume that generating a new wrapping key and import token is the safer option. Then reimport the original key material and you will be good to go.
C is the correct answer.
For the existing KMS key, as long as the original "PLAINTEXT" key material is available, you can download a new wrapping key and a new import token, and import the original key material into the existing KMS key.
Download a new wrapping key and a new import token. Import the original key material into the existing CMK.
Explanation:
Download a New Wrapping Key and Import Token:
Request a new wrapping key and a new import token from AWS Key Management Service (KMS). These are needed to securely import the key material.
Import the Original Key Material into the Existing CMK:
Use the newly obtained wrapping key and import token to import the original key material back into the existing CMK.
Why Option C is Correct:
This option allows the Security Engineer to obtain fresh components (wrapping key and import token) for the import process.
Importing the original key material into the existing CMK ensures that the restored key material has the same key ID and other properties as the original material.
You must download a new public key and import token for each import operation. You can use the same or a different wrapping algorithm for each import operation on a KMS key.
Each time you import key material to a KMS key, you need to download and use a new wrapping key and import token for the KMS key. The wrapping procedure does not affect the content of the key material, so you can use different wrapping keys (and different import tokens) to import the same key material.
https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
C : https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material .. New wrapping key and import token on the existing CMK
When you manually delete imported key material, AWS KMS deletes the key material but does not delete the KMS key or its metadata. No need to create another key here.
C should be the answer.
C is the answer.
"Each time you import key material to a KMS key, you need to download and use a new wrapping key and import token for the KMS key"
Reference: From 'How to reimport key material' section in this link:
https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material
C is correct here
Each time you import key material to a CMK, you need to download and use a new wrapping key and import token for the CMK. The wrapping procedure does not affect the content of the key material, so you can use different wrapping keys (and different import tokens) to import the same key material.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
DayQuil
Highly Voted 3 years, 9 months agocldy
Highly Voted 3 years, 9 months agoRaphaello
Most Recent 1 year, 4 months agoRosenYordanov
1 year, 7 months agoaddy_prepare
1 year, 10 months agoKezuko
2 years, 2 months agoshahs10
2 years, 3 months agosapien45
2 years, 10 months agoRja148393
2 years, 11 months agosam_live
3 years, 6 months agoNivNZ
3 years, 7 months agokiev
3 years, 8 months agoChinkSantana
3 years, 8 months agoJAWS1600
3 years, 9 months ago