A key administrator schedules a Cloud KMS key version for destruction and wants the most time possible to notice a mistake before the cryptographic material is removed. What is the longest pending window available?
Show answer and explanation
Answer: A
Cloud KMS keeps a key version that is scheduled for destruction in a pending state for a configurable period, which can be set from one day up to 120 days. The version cannot be used for cryptographic operations during that time, but it can be restored. Once the window closes, the key material is removed for good, and any data encrypted only with that version becomes unrecoverable. The default is 24 hours, so teams should set a longer window deliberately.
Why the other options are wrong
- B. Thirty days is a valid setting, but it is not the longest one available. A longer window gives more time to catch an error before the material is removed.
- C. Ninety days is also allowed, yet it falls short of the maximum. Choosing it would give less recovery time than the longest option.
- D. A 365-day window is not offered. Cloud KMS caps scheduled destruction well below a year, so this option cannot be configured.