AZ-500 exam dumps: questions 201 to 273 of 273

Correct answers: A, C

• A. Correct.

  Correct. Enabling the system-assigned managed identity and granting it the appropriate Key Vault access (e.g., get and list permissions) ensures the App Service can securely retrieve the certificate from Key Vault when it updates.

• B. Incorrect.

  Incorrect. Simply configuring App Service Application Settings without referencing Key Vault does not enable automatic retrieval or rotation of certificates. You must integrate the Key Vault reference to automate this process.

• C. Correct.

  Correct. Key Vault can automatically renew certificates with a valid issuer if you configure the lifecycle policy (auto-renew). This setup ensures the service handles renewals and even allows for notifications before expiration.

• D. Incorrect.

  Incorrect. Manually exporting and re-importing the certificate each time it expires defeats the purpose of automation. Key Vault’s certificate lifecycle management is designed to avoid manual updates.

Correct answer: A

• A. Correct.

  Correct. Azure Key Vault now supports built-in key rotation policies. You can set the rotation interval to 90 days and configure notifications. This provides an automated and low-overhead approach that doesn’t disrupt the application because older key versions remain accessible until you choose to disable them, ensuring continuity.

• B. Incorrect.

  Incorrect. While Azure Automation could rotate keys, you would still have to delete and recreate them manually or via scripts, leading to higher administrative overhead. Additionally, forcefully deleting old keys could break applications still referencing the older key version.

• C. Incorrect.

  Incorrect. Azure AD role assignments do not directly handle key lifecycle management or enforce rotation schedules on specific keys. They control who can access or manage the keys, but they do not rotate the keys themselves automatically.

• D. Incorrect.

  Incorrect. Manually rotating the key every 90 days is prone to human error and requires constant supervision. It also increases the risk of disruption if an administrator forgets or is unavailable.

Correct answer: B

• A. Incorrect.

  Option 1 is incorrect. Manually creating a new key version every 90 days relies on manual intervention and does not leverage the built-in rotation policy in Azure Key Vault. While an Event Grid subscription can notify administrators, it does not enable automatic rotation.

• B. Correct.

  Option 2 is correct. To ensure automatic rotation, you must configure a key rotation policy in Azure Key Vault with a 'Rotate' lifetime action set for a specific interval (e.g., 'timeAfterCreate' of 90 days). This properly instructs Key Vault to generate a new key version automatically.

• C. Incorrect.

  Option 3 is incorrect. While you can rotate keys using scripts, creating a scheduled script and blocking access via firewall rules is a more manual approach and does not reflect the built-in key rotation policy, which is specifically intended to automate this process.

• D. Incorrect.

  Option 4 is incorrect. Disabling soft delete and relying on Azure AD does not enable automatic key rotation. Soft delete and Azure AD access policies serve different security functions and do not replace the rotation policy feature.

Correct answers: A, B

• A. Correct.

  Option 1 is correct. Azure Key Vault provides a built-in rotation policy that allows you to specify 'expiryTime' for keys. Setting this to 90 days ensures that the key rotation process occurs automatically at the specified interval.

• B. Correct.

  Option 2 is correct. To send email alerts before the key expires, you can use Azure Event Grid subscriptions with Key Vault’s near-expiry event. Configuring this event to trigger 14 days before the key’s expiration fulfills the notification requirement.

• C. Incorrect.

  Option 3 is incorrect. Enabling Microsoft Defender for Key Vault helps detect potential threats and intrusions but does not rotate keys automatically or provide pre-rotation alerts. It focuses on security insights rather than key lifecycle management.

• D. Incorrect.

  Option 4 is incorrect. While Azure Policy can audit or deny non-compliant resources, it does not automatically rotate keys. Azure Policy is typically used to ensure resources follow organizational standards, not to enforce rotating keys on a fixed schedule.

Correct answer: A

• A. Correct.

  Option 1 is correct. Azure Key Vault supports backing up and restoring secrets, keys, and certificates within the same Azure AD tenant, even across different subscriptions, as long as the Key Vaults share the same SKU (Premium in this case). The recommended approach is to perform a backup from the source Key Vault, securely store the backup file, then restore it to the target Key Vault in the new subscription.

• B. Incorrect.

  Option 2 is incorrect because there is no built-in Azure portal feature that directly copies secrets, keys, and certificates from one Key Vault to another across subscriptions without creating a backup. The backup and restore process is the supported method.

• C. Incorrect.

  Option 3 is incorrect. Soft delete helps recover deleted items within the same Key Vault. It does not automatically synchronize or copy content from one Key Vault to another. Soft delete is for recovering accidentally deleted secrets, keys, or certificates within the same vault.

• D. Incorrect.

  Option 4 is incorrect. Azure Key Vault does allow backup and restore across subscriptions within the same tenant, provided the vaults are of the same SKU. You do not need to recreate keys and certificates from scratch, as cross-subscription backup and restore is indeed supported.