AZ-500 Question 152
Single answerYou are an Azure Security Administrator responsible for maintaining a mission-critical application that uses a storage account. Your organization mandates monthly rotation of storage account keys. The application is currently using the primary key. You need to rotate the primary key without causing any downtime for the application. Which of the following approaches should you take?
- A
Stop the application, regenerate both keys, and update the application to use the newly regenerated primary key before restarting.
- B
Configure the application to use the secondary key first, regenerate the primary key, and then update the application to use the new primary key.
- C
Regenerate the primary key immediately and rely on Azure to update the application’s configuration automatically.
- D
Generate a shared access signature (SAS) for the application to temporarily use while you regenerate both keys.
Show answer and explanation
Correct answer: B
Explanation
Azure’s best practice for rotating storage account access keys without disrupting active applications involves switching traffic to the secondary key first, then regenerating the primary key, and finally updating services to use the new primary key. This ensures no downtime or loss of access occurs. Refer to Microsoft’s documentation on managing storage account access keys for more detailed guidance: https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage.
- A. Incorrect.
Option 1: This approach would cause downtime. Stopping the application before making changes might ensure safety, but it fails the requirement of continuous availability.
- B. Correct.
Option 2: Correct. Switching to the secondary key first ensures that the application continues running without interruption. Once the application is confirmed to be using the secondary key, you can safely regenerate the primary key. Afterwards, you can reconfigure the application to use the newly rotated primary key.
- C. Incorrect.
Option 3: Incorrect. Simply regenerating the primary key without first moving the application to the secondary key risks breaking connectivity until you update the application, leading to downtime.
- D. Incorrect.
Option 4: SAS tokens are recommended for limited-scope or temporary access, not as a primary solution for monthly key rotation in a long-running production scenario. This would not address the long-term requirement to rotate and securely store the primary keys themselves.