A regional bank encrypts loan archives with KMS in eu-central-1 and must retain keys for 7 years, prove external HSM origin, and crypto-shred data on regulator order without deleting audit history. Which key-material property should the architect validate to confirm imported key material fits the retention requirement?
Select an answer to reveal the explanation.
Short Explanation
You've got the shredder in your hands here, not AWS. With expiration you can make imported material vanish on command while the key's history stays for auditors.
Full Explanation
Imported key material (BYOK) separates the KMS key container from the cryptographic bytes, so the customer controls validity through an expiration time and can delete or re-import material to enable or crypto-shred without deleting the key ID, alias, or CloudTrail history needed for seven-year audits. AWS generated material reverses that responsibility because AWS creates and protects the randomness inside HSMs and optionally handles automatic rotation, which cannot provide external provenance or manual shredding. Automatic rotation with AWS generated material fails the external HSM origin and on-demand shredding need because rotation creates new AWS material rather than expiring customer material. AWS managed keys fail because the customer cannot set expiration or control material lifecycle since AWS owns rotation and usage. Claiming imported material gets AWS automatic rotation fails conceptually because KMS disables automatic rotation for imported keys precisely since AWS does not possess the source bytes. For the exam remember imported equals customer-controlled lifetime with no auto-rotation, and in practice check key state, expiration model, and the import wrapping-key process and expiration model before approval.