How should encryption keys be managed?

• A. Storing keys locally on every server.
• B. Sharing keys via insecure channels like email.
• C. Using keys without rotation or access controls.
• D. Centralized key management, access controls, rotation, and audit of key usage.

Answer: (D)

Centralized management of encryption keys with strict access controls, regular rotation, and auditing addresses the main risk: keys are highly sensitive and a single exposure can compromise data across systems. Storing keys on every server increases attack surface and makes revocation and updates cumbersome. Sharing keys through insecure channels defeats confidentiality. Rotating keys limits the amount of data exposed if a key is compromised, access controls restrict who can use keys, and auditing provides visibility and accountability. Using a centralized solution, such as an HSM or cloud-based KMS, helps enforce these practices consistently.