What is required regarding retirement or replacement of keys when compromise is suspected?

• A. Retire or replace the key; securely archive retired keys
• B. Reuse the key after it is compromised
• C. Delete all references and continue using keys
• D. Publicly disclose compromised keys

Answer: (A)

When there’s any suspicion that cryptographic keys may have been compromised, you must retire or replace the affected key and securely archive the retired key material. This protects data and systems because a compromised key could allow an attacker to decrypt sensitive information or forge signatures. Replacing the key creates new cryptographic material that isn’t accessible to the threat, and retiring the old key prevents it from being used again. Secure archival of retired keys is important for audits and forensic investigations, providing a trail of what happened and how the keys were managed.

Why the other actions aren’t appropriate: reusing the compromised key keeps the door open for unauthorized access; deleting references and continuing uses leaves production in a risky state and undermines protection; publicly disclosing compromised keys is a separate communication step and does not itself stop misuse or prevent data exposure in the meantime.