Exam AWS Certified Security - Specialty topic 1 question 103 discussion

because deleting CMK has no immediate effect on the EC2 instance or the EBS volume. The reason is that Amazon EC2 is using the plaintext data key—not the CMK—to encrypt all disk I/O while the volume is attached to the instance. However, when the encrypted EBS volume is detached from the EC2 instance, Amazon EBS removes the plaintext key from memory. The next time the encrypted EBS volume is attached to an EC2 instance, the attachment fails, because Amazon EBS cannot use the CMK to decrypt the volume's encrypted data key

I think Danao works for AWS lol

How is A the answer? This is not possible because the data is encrypted, and without the CMK, you cannot decrypt it.

Correct answer is A. Well explained by INASR.

The answer is A because we need to take a snapshot to recover data from the encrypted EBS volume. The question states that the original encryption key for the encrypted volume has been deleted.

official reference: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html "You perform an action that makes the KMS key unusable. This has no immediate effect on the EC2 instance or the EBS volume. Amazon EC2 is using the plaintext data key—not the KMS key—to encrypt all disk I/O while the volume is attached to the instance."

Correct answer: A

A is Correct : You schedule the CMK for deletion, which makes it unusable. This has no immediate effect on the EC2 instance or the EBS volume, because Amazon EC2 is using the plaintext data key—not the CMK—to encrypt disk I/O to the EBS volume.

Ans: A

Answer : A . data still in EBS volume. you should back it up before detaching

A is Correct

Ans > A https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html#deleting-keys-how-it-works

Ans (A)

That guy is Kimo with a different name now I promise. On another note thank you to all the technical fellows here. When I am in doubt you all always clear things up and I hope my post of real world use on some of the questions help also. Maybe one day we will have a technical guild like the middle ages.

A, because the key will remain plain-text in the memory until the instance depatched

I will go with A

A, for sure.