A team schedules deletion of a KMS customer managed key. What happens next?
Show answer and explanation
Answer: A
Scheduling a KMS key for deletion puts it into the PendingDeletion state for a waiting period of 7 to 30 days. During that time the key cannot be used for cryptographic operations, and the team can cancel the deletion. Once the period ends, the key is permanently deleted and data encrypted under it cannot be recovered. KMS does not decrypt data on the team's behalf, and disabling a key is a separate state from scheduled deletion.
Why the other options are wrong
- B. KMS never deletes keys instantly when deletion is scheduled. The waiting period exists precisely so the team can cancel if the deletion was a mistake.
- C. KMS does not decrypt stored data as part of key deletion. The encrypted data simply becomes unrecoverable once the key is gone.
- D. A key in PendingDeletion cannot be simply re-enabled. The team must cancel the scheduled deletion, and disabling is a different action from scheduling deletion.