AZ-104 Question 69
Single answerYour organization’s security policy mandates periodic rotation of storage account access keys for an Azure Storage account used by multiple critical applications. You need to rotate the keys in a way that ensures minimal downtime. Which approach should you use?
- A
Generate a new set of keys and immediately replace all existing references with the newly generated key in production.
- B
Regenerate the secondary key, update application references to the secondary key, then regenerate the primary key after confirming the switch.
- C
Create an entirely new storage account, migrate all data, and ask all applications to switch to the new account.
- D
Delete the access keys from Azure Key Vault and create new secrets for all applications to use.
Show answer and explanation
Correct answer: B
Explanation
By regenerating and switching to the secondary key first, you ensure ongoing application availability while rotating the primary key later. This approach follows Microsoft’s recommended method for rotating storage account keys with minimal service disruption.
- A. Incorrect.
Replacing the original key immediately could cause downtime since all references need updating at once, risking simultaneous failures.
- B. Correct.
Best practice for minimizing downtime is to regenerate the secondary key first, update references, then rotate the primary after verifying the switch.
- C. Incorrect.
Creating a new storage account for rotation is unnecessarily complex and can still lead to downtime while applications are reconfigured.
- D. Incorrect.
Simply deleting old secrets in Key Vault and creating new ones does not address the need to smoothly transition existing references to the new keys.