AZ-500 Question 202
Single answerYou manage an application that uses an RSA key stored in Azure Key Vault for encrypting sensitive data. A new security mandate requires that the key be automatically rotated every 90 days to meet compliance requirements. Additionally, you want to avoid complex manual oversight. Which approach best satisfies these requirements with minimal administrative overhead while ensuring the application continues to function correctly during the rotation process?
- A
Configure a rotation policy for the RSA key in Azure Key Vault to automatically rotate every 90 days and optionally send notification before rotation.
- B
Create a scheduled script in Azure Automation to forcefully delete the old key version every 90 days and manually create a new key version at that time.
- C
Use role assignments in Azure Active Directory (Azure AD) to enforce key rotation by disabling access to keys older than 90 days.
- D
Manually generate a new key version in the Azure portal every 90 days and update all applications immediately.
Show answer and explanation
Correct answer: A
Explanation
Azure Key Vault offers a built-in rotation policy feature that automates the creation of a new key version on a specified schedule (such as every 90 days). It also allows you to configure notifications when rotation is due, reducing administrative effort while ensuring compliance. Reference: https://learn.microsoft.com/azure/key-vault/keys/how-to-rotate-keys
- A. Correct.
Correct. Azure Key Vault now supports built-in key rotation policies. You can set the rotation interval to 90 days and configure notifications. This provides an automated and low-overhead approach that doesn’t disrupt the application because older key versions remain accessible until you choose to disable them, ensuring continuity.
- B. Incorrect.
Incorrect. While Azure Automation could rotate keys, you would still have to delete and recreate them manually or via scripts, leading to higher administrative overhead. Additionally, forcefully deleting old keys could break applications still referencing the older key version.
- C. Incorrect.
Incorrect. Azure AD role assignments do not directly handle key lifecycle management or enforce rotation schedules on specific keys. They control who can access or manage the keys, but they do not rotate the keys themselves automatically.
- D. Incorrect.
Incorrect. Manually rotating the key every 90 days is prone to human error and requires constant supervision. It also increases the risk of disruption if an administrator forgets or is unavailable.