An annual key rotation policy now applies to the encrypted backup stores, and the DBA objects that rotation means weeks of rewriting petabytes of backup data. What is the accurate answer about key rotation on these systems?
Select an answer to reveal the explanation.
Short Explanation
The 'rewrite the petabyte' fear comes from imagining the data itself getting re-scrambled. Rotation actually changes the vault layer that wraps the keys - the huge pile of encrypted data stays exactly where it is while only the lock around the key changes. That's precisely why you can put rotation on a calendar instead of a project plan.
Full Explanation
Hierarchical cryptography is what keeps rotation cheap: data is protected by keys, and those keys are in turn wrapped by management-layer keys. Rotating the wrapping layer means new key versions protect the existing hierarchy - the bulk ciphertext never moves - so the work takes minutes, making periodic rotation feasible even on very large stores. This is the distinction policy-writers need: their requirement is satisfiable at the layer where keys live, not the layer where data lives. A full decrypt-re-encrypt sweep describes a flat single-key model; hierarchical design exists so rotating management keys spares bulk data, and picturing a rewrite is what leaves policies unenforced. Pinning data to its creating key confuses lineage with protection immutability: wrapped keys can be re-wrapped, otherwise no key management system anywhere could rotate anything. Equating rotation with the unlock passphrase understates the control - the passphrase gates access to the hierarchy; rotating it is an access ceremony, not the rotation the policy specifies. Exam caveat: read the policy carefully - wrapping-key rotation and a full data-layer re-key are completely different projects, and only the first one fits an annual calendar. Operational check: after a rotation, confirm KMS key-version metadata advanced, unlock normally in the next maintenance window, and log the result as evidence.