The correct answer is Limit the amount of data exposed when a key is compromised.

Rotating keys reduces the amount of data encrypted under any single key and shortens the time an attacker can use a compromised key. Regular key changes enforce shorter cryptoperiods and limit the window of exposure, and that is why key rotation is a core element of key lifecycle management.

Satisfy audit and regulatory lifecycle requirements for keys is not the best choice because compliance may require documented key policies and evidence of lifecycle processes, but the primary technical reason to rotate keys is to reduce exposure, not simply to satisfy audits.

Permanently remove old keys from all storage locations is incorrect because rotation alone does not guarantee the deletion of every copy of an old key from backups or archives. Secure retirement and destruction of keys is a separate lifecycle action that must be performed explicitly.

Ensure keys are always held inside hardware security modules is wrong because rotation does not by itself determine where keys are stored. Using HSMs is a best practice for protecting keys but it is an independent control that must be implemented alongside rotation.

Full AWS Practitioner Certification Question