A company uses envelope encryption for petabytes of object data and must rotate its master key every year without re-encrypting the stored data itself. How is this achieved?
Select an answer to reveal the explanation.
Short Explanation
You don't repaint the whole house to change the front-door lock. With envelope encryption, you rotate the master key and just re-seal the small data keys under it, while the petabytes stay put. Don't kill the old master key before the re-wrap is done, or you've locked yourself out.
Full Explanation
In envelope encryption the master key, or key-encryption key, protects only the data encryption keys, not the data directly. Rotating the master key therefore means creating a new version and re-wrapping the stored data keys with it, which involves small key blobs rather than the bulk data. The objects remain encrypted under their existing data keys, so petabytes never need to be read and rewritten. Many key services also retain prior key versions for unwrapping until re-wrap completes, which supports a staged migration. Rotating every data key and re-encrypting each object is a valid but different operation, used when data keys themselves are suspected compromised, and it is exactly the cost the requirement wants to avoid. Disabling the old master key immediately is harmful, because data keys still wrapped under it can no longer be unwrapped, making the data unreadable until they are re-wrapped. Exporting the master key to the application tier defeats the purpose of keeping it inside the key service or HSM and expands the attack surface. Exam caveat: rotation of the master key does not protect data if a data key was already exposed in cleartext. Operational check: confirm the rotation schedule, that re-wrap jobs complete, and that old versions are retired only afterward.