Rotating encryption keys | AWS Certified AI Practitioner (AIF-C01) original practice question

5.2Standard

AI logs use a KMS key.

Plan key renewal and recovery.

Choose two practices.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

自動または計画的なローテーション、利用者・管理者の分離、アクセスログを設定する: Exposure and privilege are controlled.
旧鍵で暗号化したデータの復号、再暗号化、無効化、バックアップ復旧をテストする: Availability survives renewal.
鍵を更新したら旧暗号文を全て即時復号できなくする: Retained data is lost.
鍵管理者へ暗号化データの常時読み取り権限を与える: Separation of duties is violated.

Detailed explanation

CorrectUse scheduled rotation, separate administrators and users, and log key access

Exposure and privilege are controlled.

CorrectTest old-ciphertext decryption, re-encryption, disablement, and recovery

Availability survives renewal.

IncorrectMake old ciphertext unreadable immediately after rotation

Retained data is lost.

IncorrectGive key administrators permanent data-read access

Separation of duties is violated.

An example you can run in a temporary verification environment.

AWS公式AIF-C01 Domain 5.2のKMS、鍵ローテーション、職務分離を確認する。

鍵を更新しても既存データと復旧を失わない運用を設計できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-468

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20