5.2Standard
AI logs use a KMS key.
Plan key renewal and recovery.
Choose two practices.
× Incorrect
Rotate keys, separate administrators from data users, and test decrypt, re-encrypt, disable, and backup recovery for old ciphertext.
Detailed explanation
IncorrectGive key administrators permanent data-read access
Separation of duties is violated.
IncorrectMake old ciphertext unreadable immediately after rotation
Retained data is lost.
CorrectUse scheduled rotation, separate administrators and users, and log key access
Exposure and privilege are controlled.
CorrectTest old-ciphertext decryption, re-encryption, disablement, and recovery
Availability survives renewal.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.2のKMS、鍵ローテーション、職務分離を確認する。
Official references
What to confirm
鍵を更新しても既存データと復旧を失わない運用を設計できる。
Key points
- KMS
- Rotation
- Separation of duties
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Key rotation
Replacing or advancing a cryptographic key according to a controlled schedule.
Key version
An identifiable generation of a cryptographic key used for encryption or decryption.
Question IDAWS-AIF-468
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue