KMS Key Policies and Grants Quiz

5 questions Pass: 70% +25 pts (50 with Pro)

Quiz covering Encryption at Rest

What you'll be asked

  1. What is the primary purpose of a KMS Key Policy?
  2. When should you use a KMS Grant instead of a Key Policy?
  3. If an IAM user has the 'kms:Decrypt' permission in their IAM policy, but the KMS Key Policy explicitly denies the same action, what is the result?
  4. You are configuring a KMS Key Policy for a key that will be used by an EC2 instance. Which principal should be specified in the Key Policy to allow the instance's IAM Role to use the key?
  5. A developer creates a grant for a KMS key. Later, they need to revoke this grant. What is the requirement for the revocation to be successful?

Answers and explanations come after you submit.