A company has several Customer Master Keys (CMK), some of which have imported key material. Which of the following option could be done by the security team for the key rotation? Select 2 answers from the options given below.

Answer options:

A.Enable Automatic Key rotation for CMKs that have imported key material.
B.Import new key material to an existing CMK.
C.Use CLI or console to rotate CMKs that have imported key material explicitly.
D.Import new key material to a new CMK and point the key alias to the new CMK.
E.Delete an existing CMK and a new default CMK will be created.

Answer: C and D
Option A is incorrect because you cannot enable automatic key rotation for a CMK with imported key material.
Option B is incorrect because you cannot import new material to an existing CMK.
Option C is CORRECT because AWS allows manual rotation of CMK key with imported key material using the AWS Console or CLI.
Option D is CORRECT because we can always import a new key material to a new CMK and then point the key alias to the new key.
Option E is incorrect because deleting an existing CMK will not create a new CMK.
One key per CMK
When you import key material into a CMK, the CMK is permanently associated with that key material. You can reimport the same key material, but you cannot import different key materials into that CMK. Also, you cannot enable automatic key rotation for a CMK with imported key material. However, you can manually rotate a CMK with imported key material.
For more information on key rotation, kindly refer to the below URL:
https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
For more information on importing keys, kindly refer to the below URL:
https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html