AZ-500 Question 203
Single answerYou have an Azure Key Vault containing an RSA key used to encrypt data at rest in an Azure Storage account. The security policy requires automatically rotating the key every 90 days. You configure the rotation policy in the Key Vault portal, but after 95 days, you notice the key has not rotated. Which of the following steps must you perform to ensure that Azure Key Vault automatically rotates the key on a 90-day schedule?
- A
Create a new version of the key in Key Vault manually every 90 days and use an Event Grid subscription to notify administrators of the old key version.
- B
Enable the Key Vault's key rotation policy by adding a lifetime action of type 'Rotate' and setting 'timeAfterCreate' to 90 days.
- C
Configure a Key Vault firewall rule to block all access except for a scheduled script that invokes the Set-AzKeyVaultKey command every 90 days.
- D
Disable soft delete on the Key Vault and rely on Azure AD to force key rotation every 90 days.
Show answer and explanation
Correct answer: B
Explanation
Azure Key Vault supports a built-in rotation policy that automatically generates a new key version on a specified schedule. To use it, you must configure a lifetime action of type 'Rotate' within the key rotation policy, typically specifying 'timeAfterCreate' or 'timeBeforeExpiry' for triggering. Reference: Microsoft Docs - 'Configure key rotation and expiration policies in Azure Key Vault.' Properly using these policies ensures that your keys rotate automatically without requiring manual intervention.
- A. Incorrect.
Option 1 is incorrect. Manually creating a new key version every 90 days relies on manual intervention and does not leverage the built-in rotation policy in Azure Key Vault. While an Event Grid subscription can notify administrators, it does not enable automatic rotation.
- B. Correct.
Option 2 is correct. To ensure automatic rotation, you must configure a key rotation policy in Azure Key Vault with a 'Rotate' lifetime action set for a specific interval (e.g., 'timeAfterCreate' of 90 days). This properly instructs Key Vault to generate a new key version automatically.
- C. Incorrect.
Option 3 is incorrect. While you can rotate keys using scripts, creating a scheduled script and blocking access via firewall rules is a more manual approach and does not reflect the built-in key rotation policy, which is specifically intended to automate this process.
- D. Incorrect.
Option 4 is incorrect. Disabling soft delete and relying on Azure AD does not enable automatic key rotation. Soft delete and Azure AD access policies serve different security functions and do not replace the rotation policy feature.