AWS Certified DevOps Engineer - Professional DOP-C02Demo

By Amazon · Question Mode

QuestionQ8

Security and Compliance

A company uses AWS Key Management Service (AWS KMS) keys with manual key rotation to satisfy regulatory compliance requirements. The security team needs notification whenever any keys have gone more than 90 days without rotation.

Which solution will achieve this?

  • A Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
  • B Configure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic.
  • C Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
  • D Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
Explanation

An AWS Config custom rule can run periodically and apply custom compliance logic to KMS keys, including determining whether the organization’s manual-rotation interval exceeds 90 days. AWS Config can send Amazon SNS notifications for resource compliance-state changes, enabling notification when a key becomes noncompliant. AWS KMS manual rotation consists of replacing a current KMS key with a new one, so this age-based requirement requires custom evaluation rather than a native KMS notification.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!