AZ-500 Question 204
Select 2Your financial services company uses Azure Key Vault to store the encryption keys for a critical application. The application processes sensitive data, and the risk team requires that all keys rotate automatically every 90 days. They also want an email alert 14 days before each key’s scheduled rotation so they can review usage logs. You plan to set up an automatic rotation policy in Azure Key Vault and configure alerts. Which of the following steps should you implement to meet these requirements? (Choose two.)
- A
- Configure a rotation policy in Azure Key Vault with an 'expiryTime' set to 90 days for the target key.
- B
- Subscribe to the near-expiry event in Azure Key Vault via Event Grid and trigger an email notification 14 days before expiration.
- C
- Enable Microsoft Defender for Key Vault (formerly advanced threat protection) to automatically rotate keys and send pre-rotation alerts.
- D
- Deploy an Azure Policy assignment to forcibly rotate Key Vault keys older than 90 days.
Show answer and explanation
Correct answers: A, B
Explanation
To configure key rotation in Azure Key Vault, you must set up a rotation policy that defines key expiration (e.g., 90 days) and create a corresponding notification mechanism. Azure Event Grid provides the near-expiry event, which can be used to alert or automate workflows before a key's scheduled rotation. Refer to Microsoft documentation on 'Manage rotation policy in Key Vault' for detailed steps and best practices.
- A. Correct.
Option 1 is correct. Azure Key Vault provides a built-in rotation policy that allows you to specify 'expiryTime' for keys. Setting this to 90 days ensures that the key rotation process occurs automatically at the specified interval.
- B. Correct.
Option 2 is correct. To send email alerts before the key expires, you can use Azure Event Grid subscriptions with Key Vault’s near-expiry event. Configuring this event to trigger 14 days before the key’s expiration fulfills the notification requirement.
- C. Incorrect.
Option 3 is incorrect. Enabling Microsoft Defender for Key Vault helps detect potential threats and intrusions but does not rotate keys automatically or provide pre-rotation alerts. It focuses on security insights rather than key lifecycle management.
- D. Incorrect.
Option 4 is incorrect. While Azure Policy can audit or deny non-compliant resources, it does not automatically rotate keys. Azure Policy is typically used to ensure resources follow organizational standards, not to enforce rotating keys on a fixed schedule.