Master key management vocabulary: key rotation, key wrapping, HSM, KMS, master keys, data encryption keys (DEK), and AWS KMS usage.
0 / 14 completed
1 / 14
What is 'key rotation' and why is it a security best practice?
Key rotation limits the blast radius of a key compromise: if a key is stolen, only data encrypted under that key (within its active period) is at risk. Automated rotation (e.g. every 90 days in AWS KMS) is a standard security control.
2 / 14
What is 'key wrapping'?
Key wrapping uses a master key or KEK to encrypt (wrap) a DEK for storage or transmission. Only someone with the master key can unwrap the DEK. This is the core of envelope encryption used by AWS KMS, GCP KMS, and Azure Key Vault.
3 / 14
What is an HSM (Hardware Security Module)?
An HSM is a physical device hardened against tampering and key extraction. It generates keys internally, performs cryptographic operations inside the device, and is certified to FIPS 140-2 Level 3 or higher — the gold standard for key protection.
4 / 14
A team says 'we store our encryption keys in AWS KMS'. What does this mean in practice?
AWS KMS stores master keys in FIPS-validated HSMs. Applications call the KMS API to encrypt/decrypt data — the plaintext key never leaves KMS. KMS integrates with CloudTrail for full audit logging of every key usage event.
5 / 14
What is the difference between a 'master key' and a 'data encryption key (DEK)' in envelope encryption?
Envelope encryption separates concerns: DEKs are generated per-resource and used to encrypt data (fast, local). DEKs are then wrapped by the master key (CMK) for storage. Only the CMK needs to be tightly controlled in the KMS — DEKs can be stored alongside the encrypted data.
6 / 14
Reviewer: 'I'm noticing we're using a single key to encrypt the entire user database. That's a significant security risk – consider splitting it into separate keys for sensitive data like passwords and payment information. We should also implement regular key rotation.'
Which of the following best reflects the reviewer's concern and proposed solution?
The reviewer's comment highlights the danger of storing all encryption keys in one place, creating a single point of failure. If this key were compromised, an attacker could access *all* encrypted data. The proposed solution—splitting keys based on sensitivity and regularly rotating them—is a standard security best practice to mitigate this risk; simply having password reset procedures doesn't address the core problem of concentrated key management.
7 / 14
Reviewer: 'I'm noticing we're using a single key to encrypt the entire user database. That's a significant security risk – consider splitting it into separate keys for sensitive data like passwords and payment information. We should also implement regular key rotation.'
Which of the following best reflects the reviewer's concern and proposed solution?
The reviewer's comment highlights the danger of storing all encryption keys in one place, creating a single point of failure. If this key were compromised, an attacker could access *all* encrypted data. The proposed solution—splitting keys based on sensitivity and regularly rotating them—is a standard security best practice to mitigate this risk; simply having password reset procedures doesn't address the core problem of concentrated key management.
8 / 14
Reviewer: 'I'm noticing we're using a single key to encrypt the entire user database. That's a significant security risk – consider splitting it into separate keys for sensitive data like passwords and payment information. We should also implement regular key rotation.'
Which of the following best reflects the reviewer's concern and proposed solution?
The reviewer's comment highlights the danger of storing all encryption keys in one place, creating a single point of failure. If this key were compromised, an attacker could access *all* encrypted data. The proposed solution—splitting keys based on sensitivity and regularly rotating them—is a standard security best practice to mitigate this risk; simply having password reset procedures doesn't address the core problem of concentrated key management.
9 / 14
Reviewer: 'I'm noticing we're using a single key to encrypt the entire user database. That's a significant security risk – consider splitting it into separate keys for sensitive data like passwords and payment information. We should also implement regular key rotation.'
Which of the following best reflects the reviewer's concern and proposed solution?
The reviewer's comment highlights the danger of storing all encryption keys in one place, creating a single point of failure. If this key were compromised, an attacker could access *all* encrypted data. The proposed solution—splitting keys based on sensitivity and regularly rotating them—is a standard security best practice to mitigate this risk; simply having password reset procedures doesn't address the core problem of concentrated key management.
10 / 14
Alex: 'Okay team, I've generated a new API key for our staging environment. We should just use this one until we deploy to production.' What is the primary security concern Alex raises?
Alex highlights a critical vulnerability: sharing an API key across environments. This means if the staging key is compromised, all data processed through it – including sensitive user information – is at risk. Rotating keys regularly limits the blast radius of a breach and prevents unauthorized access.
11 / 14
Sarah (in a Slack channel) writes: 'Just deployed the new encryption module. Using kms:encrypt to protect all data.' What does Sarah's message *primarily* indicate?
Sarah is utilizing AWS Key Management Service (KMS), a managed service for securely storing and managing encryption keys. KMS provides features like key rotation, access controls, and auditing – crucial components of a robust key management strategy. Simply using kms:encrypt doesn't fully describe the implementation.
12 / 14
During a standup meeting, Ben says, 'We're using an HSM to store our master encryption key. It's in a physically secure location and only accessible by authorized personnel.' What is the *most* important function of the HSM Ben describes?
The primary purpose of an HSM is to provide a highly secure environment for storing cryptographic keys. HSMs are designed to resist physical tampering and unauthorized access, ensuring the master key remains protected from threats like theft or malware. This protects against key compromise during both normal operation and potential attacks.
13 / 14
David (in a code review comment) writes: 'I'm concerned about using the same key to encrypt both user passwords and payment information. A compromise of one could expose *both*.' What security principle is David highlighting?
David correctly identifies the principle of least privilege. Using a single key to protect both passwords and payment information creates a significant vulnerability; if that key is compromised, *all* sensitive data is at risk. Splitting keys based on data sensitivity mitigates this dramatically.
14 / 14
Emily explains: 'We're employing envelope encryption – one master key encrypts a DEK, and the DEK encrypts the actual data.' What does 'DEK' stand for in this context?
DEK stands for 'Data Encryption Key.' It's the key that's actually used to encrypt and decrypt the data itself. Using a DEK derived from a master key (or 'key wrapping') provides an added layer of security – if the DEK is compromised, the data remains protected because it was encrypted with the master key.
What does the "Key Management Vocabulary Quiz" exercise cover?
Master key management vocabulary: key rotation, key wrapping, HSM, KMS, master keys, data encryption keys (DEK), and AWS KMS usage.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Key Management Vocabulary Quiz"?
This exercise has 14 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Cryptography & PKI exercises?
Browse the full Cryptography & PKI hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.