In your organization, the security team requires that the key material of CMKs should be generated and maintained in your own infrastructure. Therefore you have created key material in local servers and got it imported. Then the CMKs are used for encryption/decryption with various AWS services. Which configurations or operations can you perform on these CMKs? (Select TWO.)

Answer options:

A.Enable automatic key rotation so that the key material is automatically rotated every year.
B.Schedule key deletion and set a waiting period of 7 to 30 days.
C.Manually delete the imported key material.
D.Export the key material through AWS KMS CLI.
E.Import a different key material into the same CMK.

Correct Answer – B, C
When users create a new CMK, the key material origin can be selected as External which means the key material will be imported.
Reference can be found in
https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html.
Option A is incorrect: Because automatic key rotation is not an option for CMKs with imported key material.
Option B is CORRECT: Because Schedule key deletion can still be configured.
Option C is CORRECT: Because users can manually delete the key material. After that, AWS KMS deletes the key material but does not delete the CMK or metadata.
Option D is incorrect: Because AWS KMS NEVER provides CLI command or API to export key material outside of KMS.
Option E is incorrect: Because users can reimport the key material. However, the key material must be the same. Refer to the above link.