AZ-500 Question 151
Select 2You are managing a production Azure Storage account that is used by multiple critical applications. Your organization mandates regular rotation of storage account keys to meet security requirements. You want to perform the rotation with minimal disruption to the applications, which currently use the primary access key. Which two actions should you take to achieve this goal?
- A
Regenerate the primary key first while applications are still pointing to it.
- B
Update application configurations to use the secondary key, then regenerate the primary key.
- C
Regenerate both the primary and secondary keys simultaneously for a quicker rotation.
- D
Use Azure Key Vault’s built-in key rotation to automate and handle key updates.
- E
Create a new storage account and migrate all data instantly to avoid key rotation complexity.
Show answer and explanation
Correct answers: B, D
Explanation
To minimize downtime, you should switch applications to use the secondary key before regenerating the primary key, creating a seamless rotation process. Additionally, Azure Key Vault provides built-in rotation and secret management features, which can automate the process of rotating secrets, including storage account keys, while keeping applications up-to-date. For reference, consult Microsoft’s official documentation on Azure Storage account key rotation and Azure Key Vault integration for best practices.
- A. Incorrect.
Option 1 is incorrect. If you regenerate the primary key first while apps are still using it, they will lose access immediately, causing downtime.
- B. Correct.
Option 2 is correct. The standard practice is to direct applications to the secondary key and then regenerate the primary key to avoid service disruption.
- C. Incorrect.
Option 3 is incorrect. Regenerating both keys at once leaves no fallback key for applications, increasing the risk of downtime if apps don’t update in time.
- D. Correct.
Option 4 is correct. Using Azure Key Vault with storage account integration can automate key rotation, ensuring you remain compliant without manual intervention.
- E. Incorrect.
Option 5 is incorrect. Creating a new storage account and migrating everything is a far more disruptive process and is not a recommended strategy for simple key rotation.