AZ-104 Question 68
Single answerYou are the Azure Administrator for a company that uses a production Azure Storage account. The application connecting to this storage account uses the primary access key for read/write operations. You suspect the primary key has been compromised and want to rotate it with no service interruption. Which approach should you take first to ensure continuous operation and secure the storage account?
- A
Regenerate the primary access key immediately and then update your application settings
- B
Switch the application to use the secondary access key first, then regenerate the primary key
- C
Export both keys to a secure local file for backup, then revoke all networking access to the storage account
- D
Create a Shared Access Signature (SAS) with no expiration to replace the primary key usage
Show answer and explanation
Correct answer: B
Explanation
To avoid downtime with a compromised primary key, the standard practice is to update the application to use the secondary key first and then regenerate the primary key. This procedure ensures continuous operation while removing any risks associated with the compromised key.
- A. Incorrect.
Regenerating the primary key immediately without first updating the application settings will cause a service interruption, as the application will no longer have a valid key until it is updated.
- B. Correct.
Switching the application to use the secondary key allows uninterrupted operations while you regenerate the primary key. Once regenerated, you can safely reconfigure the application to use the new primary key if needed.
- C. Incorrect.
Simply backing up the keys to a secure file and revoking network access will not address the immediate need to maintain continuous service and secure any compromised key.
- D. Incorrect.
While a SAS can provide granular access to storage resources, creating a long-lived or indefinite SAS does not solve the key-compromise scenario and might introduce other security risks.