AZ-104 Question 67
Single answerYou manage an Azure Storage account used by various internal applications. The primary access key for this storage account has recently been exposed, and you need to mitigate the risk of unauthorized access immediately while maintaining application availability. Which action should you perform first?
- A
Immediately regenerate the primary key from the Azure portal
- B
Switch the application's connection strings to use the secondary key, then regenerate the primary key
- C
Delete and recreate the storage account to remove the compromised key
- D
Contact Microsoft Support to rotate the access key
Show answer and explanation
Correct answer: B
Explanation
When a storage account key is compromised, the best practice is to switch any applications or services currently using that key to the alternative (secondary) key to avoid downtime. Once the applications are safely using the secondary key, you can regenerate the compromised primary key, ensuring that no unauthorized access occurs using the exposed credential.
- A. Incorrect.
Regenerating the compromised key instantly will cause downtime if your applications are currently using it, since they will no longer have valid credentials.
- B. Correct.
Switching to the secondary key first allows you to seamlessly update the application with valid credentials, ensuring continuity. Then you can safely regenerate the exposed primary key.
- C. Incorrect.
Deleting and recreating the storage account is extreme and would cause data loss without additional backups or migration steps. This is not a recommended first action for mitigating key exposure.
- D. Incorrect.
Microsoft Support can offer guidance, but they are not required to perform standard access key rotation and regeneration. This is a standard process that can be handled directly within the Azure portal.