Exam AWS Certified Security - Specialty topic 1 question 397 discussion

https://aws.amazon.com/kms/faqs/ “ You may set an expiration period for an imported key. AWS KMS will automatically delete the key material after the expiration period. You can also delete imported key material on demand. In both cases the key material itself is deleted but the KMS key reference in AWS KMS and associated metadata are retained so that the key material can be re-imported in the future. Keys generated by AWS KMS do not have an expiration time and cannot be deleted immediately; there is a mandatory 7 to 30 day wait period. All customer managed KMS keys, regardless of whether the key material was imported, can be manually disabled or scheduled for deletion. In this case the KMS key itself is deleted, not just the underlying key material.”

A is the correct one, please fix all the wrong answers.

Both C and D are instantly out, you don't have granuluar control over AWS Managed Keys. For B, you can set an expiration period and AWS will automatically delete: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-import-key-material.html When you import the key material for your KMS key, you can set an optional expiration date and time for the key material of up to 365 days from the import date. When imported key material expires, *AWS KMS* deletes it. This action changes the key state of the KMS key to PendingImport, which prevents it from being used in any cryptographic operation. To use the KMS key, you must reimport a copy of the original key material. So I would go B.

B for sure... AWS will deleted expired imported keys

imported keys cannot be automatically deleted

A, you cannot delete set2 as they are aws managed

Option B is not a viable solution because AWS does not automatically delete imported keys. , the correct it´s A

I agree B - Also I note that the Set 1 requirements specifically mentions 'reimport' and you can't re-import if you haven't imported to start with which eliminates C and D.

https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html You can only schedule the deletion of a customer managed key. You cannot delete AWS managed keys or AWS owned keys.

According to this information the only that applies is B: https://aws.amazon.com/kms/faqs/#:~:text=You%20may%20set%20an%20expiration%20period%20for%20an%20imported%20key.%20AWS%20KMS%20will%20automatically%20delete%20the%20key%20material%20after%20the%20expiration%20period.