A team needs to suspend all cryptographic use of a KMS key without destroying it, so it can be restored later if archived data must be read. Which action should they take?
Show answer and explanation
Answer: B
Disabling a key blocks encrypt and decrypt calls while leaving the key and its material intact in KMS. The account can re-enable it later, at which point existing ciphertext becomes readable again.
Deletion is irreversible once the waiting period ends, so it is a poor fit when recovery might still be needed.
Why the other options are wrong
- A. Deletion looks reversible only during the waiting window; after it completes the material is gone and the ciphertext is unrecoverable.
- C. KMS enforces a minimum waiting period, so immediate deletion is not available.
- D. Stripping the key policy can make the key unmanageable rather than cleanly pausing it, and does not restore access later.