A platform uses envelope encryption: each dataset is encrypted with its own data encryption key, and those keys are stored only in encrypted form, wrapped by a master key held in the key management service. A security administrator disabled that master key. Now no dataset can be decrypted. Which statement explains the failure?

Envelope encryption uses two tiers of keys. Data encryption keys (DEKs) encrypt the data itself and are often unique per dataset or file. Each DEK is then encrypted, or wrapped, with a key encryption key (KEK) that is kept in a key management service or hardware security module and normally never leaves it. To decrypt data, the application sends the wrapped DEK to the key service, which uses the KEK to unwrap it, and then the plaintext DEK decrypts the dataset. Because the master key in this scenario is the KEK, disabling it stops every unwrap request, so no DEK can be recovered and every dataset becomes unreadable until the KEK is re-enabled. The claim that DEKs expire automatically on rotation is false; rotating a KEK typically leaves existing wrapped DEKs decryptable with prior versions, and the scenario describes disabling, not rotation. A TLS session problem would cause connection errors to the key service, not a pattern explained by the administrator's action. Dataset checksums are integrity mechanisms and do not use the master key; a changed hashing key would not prevent decryption. Exam caveat: disabling or deleting a KEK is a powerful control, sometimes used deliberately to make data inaccessible, so it should be change-controlled. Operational check: review the key service audit log for the disable event, re-enable the KEK through change control and confirm one dataset decrypts.