Which AWS KMS Key Type Supports Immediate Deletion?

DVA-C02 By islever Editorial Last updated Aug 31, 2026

Short answer

B Use customer managed keys with imported key material. When the keys are no longer required, delete the imported key material.

Question

A developer manages encryption keys in AWS Key Management Service (AWS KMS). The developer must ensure that all encryption keys can be deleted immediately when the keys are no longer required. The developer wants a solution that is highly available and does not require manual management for compute infrastructure. Which solution will meet these requirements?

Use AWS KMS managed keys. When the keys are no longer required, schedule the keys for immediate deletion.
Use customer managed keys with imported key material. When the keys are no longer required, delete the imported key material. Correct Answer
Use customer managed keys. When the keys are no longer required, delete the key material.
Use customer managed keys and an AWS CloudHSM key store. When the keys are no longer required, schedule the keys for immediate deletion.

Key Takeaways

The exam tests whether you know that KMS key deletion always requires a 7-30 day waiting window, and the trap is the word 'immediately,' which is only achievable by deleting imported key material.

AWS KMS keys, whether AWS managed or customer managed, can never be deleted instantly and always enforce a scheduled waiting period of at least 7 days. The community consensus (83% of votes) is that only customer managed keys with imported key material allow immediate deletion by deleting the key material itself.

Common mistake: Many test-takers choose A because 'schedule the keys for immediate deletion' sounds plausible, but AWS KMS does not offer immediate deletion for any KMS key, as scheduled deletion always enforces a minimum 7-day waiting period.

Expert Analysis

Why the Answer Is Correct

Option B is correct because deleting the imported key material is the only mechanism that makes a KMS key immediately unusable. When you delete imported key material, the KMS key transitions to the PENDING_IMPORT key state instantly, with no waiting period. This satisfies the immediate-deletion requirement while remaining highly available and fully managed, since KMS is a managed service requiring no compute infrastructure to maintain. Community comments overwhelmingly support B (83 of 100 votes), with comment [2] citing the official AWS documentation on deleting imported key material.

Why the Other Options Are Wrong

Options A, C, and D all rely on scheduling key deletion, which AWS KMS never performs immediately; scheduled deletion enforces a mandatory waiting period of 7 to 30 days. Comment [1] explains that both AWS managed keys and customer managed keys cannot be deleted immediately and must go through at least a 7-day waiting period as a safety measure. Option D adds an AWS CloudHSM key store, which increases cost and operational complexity but still cannot bypass the waiting window. Comment [3] confirms that A and D, while highly available, require scheduled rather than immediate deletion.

Community Comment Notes

The most useful comments consistently back answer B, with comment [1] providing the clearest technical rationale about the 7-day minimum waiting period for KMS key deletion. Comment [2] links directly to the AWS developer guide page on deleting imported key material, which is the authoritative source for this scenario. The dissenting comment [4] favors A based on the phrase 'schedule the keys for immediate deletion,' but this misreads AWS behavior since no such immediate deletion option exists for KMS keys. With an 83% vote share and documentation-backed reasoning, B is the reliable answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Watch for absolute words like 'immediately' in KMS questions, as they usually point to imported key material rather than scheduled deletion. Remember that all KMS keys require a 7-30 day waiting window for scheduled deletion, so any option using 'schedule' fails an immediate-deletion requirement. Eliminate those options first, then select the one that deletes key material directly.

Community Votes

83%

17%

83% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Arad 👍 2 Answered B

B is the correct answer. A and C are wrong as AWS KMS managed keys (including AWS-managed keys and customer managed keys) cannot be deleted immediately. They must go through a minimum waiting period of 7 days.
ShakthiGCP 👍 2 Answered B

https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-delete-key-material.html
italiancloud2025 👍 1 Answered B

B: Con claves administradas por el cliente que utilizan material de clave importado, puedes eliminar el material de clave de forma inmediata cuando ya no se requiera. A y D: Aunque son altamente disponibles, requieren programar la eliminación (no es inmediata).
xdeveloper 👍 1 Answered A

AWS KMS allows you to schedule the keys for immediate or future deletion. This makes it easy to delete keys without manual intervention.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide