You have a set of CMKs created using the AWS KMS service. These keys have been used for around 6 months. Recently there are some new KMS features, and the default key policy is updated to include certain new permissions. How would you update the key policies of the existing CMKs?

Answer options:

A.Follow the AWS console alert in KMS and upgrade the key policies.
B.Open the existing CMKs in the AWS console and manually add the new permissions in the key policies.
C.No actions are required since the new features or permissions do not influence the existing CMKs.
D.No actions are required as the key policies are updated automatically.

Answer: A
Option A is correct because when there is a new default key policy, the AWS console has an alert. You can choose "Preview and upgrade to the new key policy". 
Option B is incorrect because you do not need to do this manually. You can follow the console alert to upgrade the key policies.
Option C is incorrect because the key policies of existing CMKs need to be modified to include the new permissions so that the new KMS features can be used.
Option D is incorrect because the key policies of existing CMKs are not updated automatically.
For more information on KMS key policy, kindly refer to the URL provided below: 
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-upgrading.html