After a contractor is offboarded, the city must re-encrypt a subset of grant files under a new data-key hierarchy so the contractor's former access path cannot decrypt them. What should the application team plan?
Select an answer to reveal the explanation.
Short Explanation
When trust changes, you do not just take back the badge — you change the locks on the files that person could open. Plan a re-encryption pass with new data keys and point the app at the rotated hierarchy.
Full Explanation
After a contractor is offboarded, ciphertext that remains decryptable under keys the contractor could use is still at risk. The application team must re-encrypt the affected grant files under new data keys or a new CMK hierarchy and update retrieve/decrypt paths to the rotated material. In municipal grants workflows, taking back a badge is incomplete if the former contractor's access path can still unwrap objects; cryptographic rotation closes that path for the subset of files that must be protected going forward.
Leaving ciphertext unchanged and only deleting the contractor's IAM console password fails because password removal does not invalidate retained key material, role credentials, or grants that still allow Decrypt. Disabling CloudTrail fails conceptually—it reduces auditability of Decrypt events precisely when rotation and offboarding need evidence. Copying old data keys into plaintext Lambda environment variables fails because it recreates secret sprawl and slows true rotation rather than completing it.
Exam caveat: re-encryption jobs must cover all copies (primary prefixes, replicas, and durable backups in scope); missing a replica leaves a decryptable remnant. Operational check: inventory objects encrypted under the old hierarchy, run a controlled re-encrypt, revoke old grants/roles, and sample-decrypt with the new keys while confirming old paths fail.