AZ-500 Question 199
Single answerYour company hosts a critical web application on Azure App Service and stores its custom SSL certificate in Azure Key Vault. You want to ensure that this certificate is automatically renewed before it expires. Which action should you take to enable automatic certificate renewal through Azure Key Vault?
- A
Enable the Key Vault soft-delete and purge protection features to allow the certificate to renew automatically
- B
Configure a certificate policy in Key Vault with lifetime actions and a valid issuer for automatic renewal
- C
Create a Key Vault secret from the existing certificate and manually update the expiration date
- D
Use Application Insights to monitor certificate expiration and trigger a manual renewal
Show answer and explanation
Correct answer: B
Explanation
To enable automatic renewal of certificates in Azure Key Vault, you must configure a certificate policy that defines an issuer (e.g., a trusted CA) and includes lifetime actions for renewal. When properly configured, Key Vault can automatically request a renewed certificate and store it in the vault, well before expiration. For more details, refer to the official Microsoft documentation on managing certificates with Azure Key Vault: https://learn.microsoft.com/azure/key-vault/certificates/about-certificates.
- A. Incorrect.
Incorrect: While enabling soft-delete and purge protection is recommended for recovery scenarios, these features alone do not enable or configure automatic certificate renewal.
- B. Correct.
Correct: Azure Key Vault certificates can be configured with a certificate policy (including lifetime actions and an issuer) to handle automatic renewal. This is the key step that ensures the certificate is automatically renewed prior to expiration.
- C. Incorrect.
Incorrect: Turning the certificate into a Key Vault secret without defining a certificate policy does not configure any sort of automatic rotation or renewal. You would have to manually update the secret.
- D. Incorrect.
Incorrect: Application Insights can monitor the expiration date, but it does not provide an automatic renewal mechanism. You would still have to renew the certificate manually, which is not the desired solution.