You’ve implemented AWS Key Management Service to protect your data in your applications and other AWS services. Your global headquarters is in Northern Virginia (US East (N. Virginia) where you created your keys and have provided the appropriate permissions to designated users and specific roles within your organization. While the N. American users are not having issues, German and Japanese users cannot get KMS to function. What is the most likely cause of it?

Answer options:

A.KMS is only offered in North America.
B.AWS CloudTrail has not been enabled to log events.
C.KMS master keys are region-specific and the applications are hitting the wrong API endpoints.
D.The master keys have been disabled.

Correct Answer: C
Option C is correct. This is the most likely cause as the application should be sure to hit the correct region endpoint.
Option A is incorrect. KMS is offered in several regions, but keys are not transferrable out of the region they were created in.
Option B is incorrect. CloudTrail is recommended for auditing but is not required.
Option D is incorrect. The keys are working as expected where they were created; keys are region-specific.
References:
https://aws.amazon.com/kms/faqs/
ttps://docs.aws.amazon.com/general/latest/gr/rande.html#kms_region
https://www.slideshare.net/AmazonWebServices/encryption-and-key-management-in-aws