When it comes to KMS, which of the following best describes how the AWS Key Management Service works? Choose the correct answer from the options below.

Answer options:

A.AWS KMS supports two kinds of keys — master keys and data keys. Master keys can be used to encrypt and decrypt up to 4 kilobytes of data directly and can also be used to protect data keys. The master keys are then used to encrypt and decrypt customer data.
B.AWS KMS supports two kinds of keys — master keys and data keys. Master keys can be used to encrypt and decrypt up to 4 kilobytes of data directly and can also be used to protect data keys. The data keys are then used to encrypt and decrypt customer data.
C.AWS KMS supports two kinds of keys — master keys and data keys. Master keys can be used to encrypt and decrypt up to 4 kilobytes of data directly and can also be used to protect data keys. The data keys are then used to decrypt the customer data, and the master keys are used to encrypt the customer data.
D.AWS KMS supports two kinds of keys — master keys and data keys. Master keys can be used to encrypt and decrypt up to 4 kilobytes of data directly and can also be used to protect data keys. The data keys are then used to encrypt the customer data, and the master keys are used to decrypt the customer data.

Answer – B
AWS KMS supports two types of keys - Master Keys and Data Keys. A Data Key is used to encrypt and decrypt the actual data; whereas, the Master Key is used to protect (encrypt and decrypt) the data key and some data up to 4Kb. See the image below:
Based on this, option B is CORRECT.
For more information on the AWS KMS Concepts, please refer to the link below-
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html