AZ-500 Question 201
Select 2You have an Azure App Service hosting a production website that uses an SSL certificate stored in Azure Key Vault. The certificate is soon expiring, so you want to ensure the certificate is automatically rotated in the Key Vault and seamlessly updated by the App Service. Which TWO actions must you perform to implement this automated certificate rotation solution?
- A
Enable a system-assigned managed identity on the App Service and grant it certificate access in Key Vault
- B
Configure the App Service to handle certificate rotation exclusively via Application Settings without referencing Key Vault
- C
Set the Key Vault certificate lifecycle policy to 'Auto-Renew' with a valid issuer and appropriate notifications
- D
Manually export the Key Vault certificate and re-import it to the App Service each time it expires
Show answer and explanation
Correct answers: A, C
Explanation
By enabling a managed identity and configuring Key Vault’s automatic certificate renewal, you let Azure handle certificate rotation transparently. Once the policy is configured for auto-renew, Azure Key Vault will acquire the new certificate from the trusted issuer, and App Service (via its managed identity) can retrieve the updated certificate. For more details, refer to Microsoft documentation on Managed Identities and Key Vault certificate lifecycle policies: https://learn.microsoft.com/azure/key-vault/certificates/certificate-lifecycle and https://learn.microsoft.com/azure/app-service/app-service-key-vault-references.
- A. Correct.
Correct. Enabling the system-assigned managed identity and granting it the appropriate Key Vault access (e.g., get and list permissions) ensures the App Service can securely retrieve the certificate from Key Vault when it updates.
- B. Incorrect.
Incorrect. Simply configuring App Service Application Settings without referencing Key Vault does not enable automatic retrieval or rotation of certificates. You must integrate the Key Vault reference to automate this process.
- C. Correct.
Correct. Key Vault can automatically renew certificates with a valid issuer if you configure the lifecycle policy (auto-renew). This setup ensures the service handles renewals and even allows for notifications before expiration.
- D. Incorrect.
Incorrect. Manually exporting and re-importing the certificate each time it expires defeats the purpose of automation. Key Vault’s certificate lifecycle management is designed to avoid manual updates.