Which AWS KMS Key Type Supports Immediate Deletion?
A developer manages encryption keys in AWS Key Management Service (AWS KMS). The developer must ensure that all encryption keys can be deleted immediately when the keys are no longer required. The developer wants a solution that is highly available and does not require manual management for compute infrastructure. Which solution will meet these requirements?
Community Votes
83% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know that KMS key deletion always requires a 7-30 day waiting window, and the trap is the word 'immediately,' which is only achievable by deleting imported key material.
AWS KMS keys, whether AWS managed or customer managed, can never be deleted instantly and always enforce a scheduled waiting period of at least 7 days. The community consensus (83% of votes) is that only customer managed keys with imported key material allow immediate deletion by deleting the key material itself.
Many test-takers choose A because 'schedule the keys for immediate deletion' sounds plausible, but AWS KMS does not offer immediate deletion for any KMS key, as scheduled deletion always enforces a minimum 7-day waiting period.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because deleting the imported key material is the only mechanism that makes a KMS key immediately unusable. When you delete imported key material, the KMS key transitions to the PENDING_IMPORT key state instantly, with no waiting period. This satisfies the immediate-deletion requirement while remaining highly available and fully managed, since KMS is a managed service requiring no compute infrastructure to maintain. Community comments overwhelmingly support B (83 of 100 votes), with comment [2] citing the official AWS documentation on deleting imported key material.Why the Other Options Are Wrong
Options A, C, and D all rely on scheduling key deletion, which AWS KMS never performs immediately; scheduled deletion enforces a mandatory waiting period of 7 to 30 days. Comment [1] explains that both AWS managed keys and customer managed keys cannot be deleted immediately and must go through at least a 7-day waiting period as a safety measure. Option D adds an AWS CloudHSM key store, which increases cost and operational complexity but still cannot bypass the waiting window. Comment [3] confirms that A and D, while highly available, require scheduled rather than immediate deletion.Community Comment Notes
The most useful comments consistently back answer B, with comment [1] providing the clearest technical rationale about the 7-day minimum waiting period for KMS key deletion. Comment [2] links directly to the AWS developer guide page on deleting imported key material, which is the authoritative source for this scenario. The dissenting comment [4] favors A based on the phrase 'schedule the keys for immediate deletion,' but this misreads AWS behavior since no such immediate deletion option exists for KMS keys. With an 83% vote share and documentation-backed reasoning, B is the reliable answer.Official Reference
Exam Strategy
Watch for absolute words like 'immediately' in KMS questions, as they usually point to imported key material rather than scheduled deletion. Remember that all KMS keys require a 7-30 day waiting window for scheduled deletion, so any option using 'schedule' fails an immediate-deletion requirement. Eliminate those options first, then select the one that deletes key material directly.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →