Learn the IT-English vocabulary of cryptographic key rotation: rotation schedules, grace periods, re-encryption and key versions.
0 / 14 completed
1 / 14
What does 'key rotation' mean?
Key rotation regularly swaps in a fresh key and retires the old to limit exposure if a key is compromised.
2 / 14
During rotation a 'grace period' is kept. Why?
A grace period lets the old key remain valid for decryption until everything is re-encrypted or expires.
3 / 14
A system supports multiple 'key versions'. What does this allow?
Versioning tags ciphertext with the key version used, so the matching key decrypts it during rotation.
4 / 14
What is 're-encryption' (rewrapping) in this context?
Re-encryption migrates existing data to the new key so the old key can finally be retired.
5 / 14
Which sentence correctly uses 'compromised key'?
A compromised key may be known to attackers; emergency rotation and revocation limit the damage.
6 / 14
Reviewer: 'I'm seeing a lot of hardcoded API keys in this PR. While I understand the need for rapid development, we absolutely *must* implement key rotation procedures according to our security policy. Specifically, can you explain how you've addressed the transition from the legacy API_KEY_V1 to the new API_KEY_V2? The documentation clearly states a phased rollout is required with validation checks at each stage.
Which of these descriptions best reflects your approach?
The correct answer highlights the phased rollout approach, which is critical for minimizing risk during key rotation. The other options demonstrate incomplete or unsafe practices – directly replacing keys without validation (option 1), a lack of documentation and planning (option 2), or simply commenting out the old key without proper monitoring (option 3). A robust key rotation strategy involves gracefully transitioning applications to new keys while verifying functionality and usage, as detailed in the security policy. This allows for immediate detection if something goes wrong.
7 / 14
Reviewer: 'I'm seeing a lot of hardcoded API keys in this PR. While I understand the need for rapid development, we absolutely *must* implement key rotation procedures according to our security policy. Specifically, can you explain how you've addressed the transition from the legacy API_KEY_V1 to the new API_KEY_V2? The documentation clearly states a phased rollout is required with validation checks at each stage.
Which of these descriptions best reflects your approach?
The correct answer highlights the phased rollout approach, which is critical for minimizing risk during key rotation. The other options demonstrate incomplete or unsafe practices – directly replacing keys without validation (option 1), a lack of documentation and planning (option 2), or simply commenting out the old key without proper monitoring (option 3). A robust key rotation strategy involves gracefully transitioning applications to new keys while verifying functionality and usage, as detailed in the security policy. This allows for immediate detection if something goes wrong.
8 / 14
Reviewer: 'I'm seeing a lot of hardcoded API keys in this PR. While I understand the need for rapid development, we absolutely *must* implement key rotation procedures according to our security policy. Specifically, can you explain how you've addressed the transition from the legacy API_KEY_V1 to the new API_KEY_V2? The documentation clearly states a phased rollout is required with validation checks at each stage.
Which of these descriptions best reflects your approach?
The correct answer highlights the phased rollout approach, which is critical for minimizing risk during key rotation. The other options demonstrate incomplete or unsafe practices – directly replacing keys without validation (option 1), a lack of documentation and planning (option 2), or simply commenting out the old key without proper monitoring (option 3). A robust key rotation strategy involves gracefully transitioning applications to new keys while verifying functionality and usage, as detailed in the security policy. This allows for immediate detection if something goes wrong.
9 / 14
Reviewer: 'I'm seeing a lot of hardcoded API keys in this PR. While I understand the need for rapid development, we absolutely *must* implement key rotation procedures according to our security policy. Specifically, can you explain how you've addressed the transition from the legacy API_KEY_V1 to the new API_KEY_V2? The documentation clearly states a phased rollout is required with validation checks at each stage.
Which of these descriptions best reflects your approach?
The correct answer highlights the phased rollout approach, which is critical for minimizing risk during key rotation. The other options demonstrate incomplete or unsafe practices – directly replacing keys without validation (option 1), a lack of documentation and planning (option 2), or simply commenting out the old key without proper monitoring (option 3). A robust key rotation strategy involves gracefully transitioning applications to new keys while verifying functionality and usage, as detailed in the security policy. This allows for immediate detection if something goes wrong.
10 / 14
Alex: 'Hey team, I've just deployed a new version of the billing microservice. It uses the updated API key for Stripe. Just let me know if you spot any issues!'
Which phrase best describes Alex's action regarding the API key?
This describes a proactive approach – deploying with updated keys is better than leaving them static. The other options misinterpret the situation; relying solely on immediate deployment ignores established security practices and doesn't directly address key rotation. Key rotation procedures involve regularly changing these credentials.
11 / 14
Sarah (Lead DevOps) sends the following message in a Slack channel: 'Okay team, we need to rotate the keys for our AWS S3 buckets. Please update the environment variables before deploying tomorrow morning. Remember to document the changes!' What is the PRIMARY goal of this message?
The core purpose is to enforce security policy. Rotating keys – changing them periodically – is crucial for mitigating risk if they are compromised. Simply informing about a feature release or requesting bug fixes doesn't address the fundamental requirement of key rotation.
12 / 14
The documentation states: 'Following a key rotation, all data encrypted with the old key must be re-encrypted using the new key.' What is this process commonly referred to as?
'Re-encryption' (or 'rewrapping') specifically refers to the process of using a new key to encrypt data that was previously encrypted with an older key. Key migration is broader and can involve various steps, while decryption simply reverses encryption; a system reset would be far too drastic a term.
13 / 14
Ben (Security Engineer) observes that a microservice uses a hardcoded API key. He recommends the following action: 'We should implement a system where the service retrieves the key from a secure vault at runtime.' What is the *main* benefit of this approach?
The primary advantage is security – storing secrets in a secure vault prevents accidental exposure via code commits or misconfigured environments. While version switching might be a *consequence*, it's not the fundamental reason for using a vault; caching would impact performance.
14 / 14
A developer submits a pull request containing hardcoded API keys. The reviewer comments: 'This is unacceptable! We need to rotate these keys immediately to minimize the impact of a potential compromise.' What does the reviewer *most* likely mean?
'Rotate' in this context means changing the keys – replacing them with new ones. The reviewer's concern is that the existing keys may be compromised (stolen or leaked) and therefore need to be replaced with fresh, secure credentials. The other options represent different issues but don't directly address the immediate risk of a compromised key.
What does the "Key Rotation Procedures" exercise cover?
Learn the IT-English vocabulary of cryptographic key rotation: rotation schedules, grace periods, re-encryption and key versions.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Key Rotation Procedures"?
This exercise has 14 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Cryptography & PKI exercises?
Browse the full Cryptography & PKI hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.