Which statement about automatic rotation of a customer managed symmetric KMS key is accurate?
Show answer and explanation
Answer: B
When automatic rotation runs, KMS creates fresh material for the key and retains earlier versions so existing ciphertext still decrypts, while the key identifier and ARN remain unchanged so applications and policies keep working.
Only newly encrypted data uses the newest material, and an on-demand rotation can also be triggered.
Why the other options are wrong
- A. KMS never rewrites existing ciphertext during rotation; re-encrypting stored data is the caller's responsibility.
- C. Stored data keys and ciphertext continue to work, so no manual re-encryption is required.
- D. Customer managed symmetric keys support rotation, while asymmetric keys do not support automatic rotation.
Exam tip. Rotation changes material, not the key identity.