AZ-500 Question 153
Select 2Your organization has an application that uses an Azure Storage account with two access keys (key1 and key2). To meet compliance requirements, you must rotate these keys every 90 days without causing downtime for the application. Which two actions should you perform to accomplish this key rotation securely and maintain uninterrupted access?
- A
Regenerate both keys simultaneously to immediately switch all applications to a new secure key.
- B
Identify the key that the application is not currently using, and regenerate that key first.
- C
Update the application to use the newly regenerated key in its configuration or connection string.
- D
Revoke the old key immediately from the access policies before updating the application.
Show answer and explanation
Correct answers: B, C
Explanation
To rotate storage account access keys with minimal downtime, follow the process of regenerating the key not currently in use, updating the application to use the newly generated key, verifying functionality, and then optionally revoking or regenerating the old key. This approach aligns with Azure documentation on key rotation best practices: https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage
- A. Incorrect.
Incorrect. Regenerating both keys at the same time can cause downtime because the application might attempt to use a key that has just been invalidated. It is best practice to regenerate one key at a time.
- B. Correct.
Correct. Azure Storage accounts provide two keys (key1 and key2) so you can regenerate one while the other is in use. This streamlines key rotation and avoids disruptions in service.
- C. Correct.
Correct. After regenerating the key, you must update all applications or services that rely on that key to use the new key before disabling the old one. This ensures uninterrupted access to the storage account.
- D. Incorrect.
Incorrect. Immediately revoking the old key before updating your application risks disrupting access. You should only revoke or regenerate the old key after confirming that your application has been updated and is functioning with the new key.