AZ-500 Question 207
Select 2You manage certificates stored in multiple Azure Key Vaults for a large enterprise. Due to an unexpected event, you need to restore a critical certificate (including all its versions) from one Key Vault instance (KV-A) to another (KV-B). Which two actions must you perform to ensure the certificate and its versions are fully preserved in KV-B?
- A
Generate a .pem file from KV-A and import it into KV-B
- B
Use the Azure CLI 'az keyvault certificate backup' command to create a backup of the certificate from KV-A
- C
Use the Azure CLI 'az keyvault certificate restore' command to apply the backup file to KV-B
- D
Export the certificate as a .pfx from KV-A and manually import it into KV-B
Show answer and explanation
Correct answers: B, C
Explanation
To preserve all versions and attributes of a certificate when moving or restoring it between Azure Key Vaults, you must use the backup and restore process rather than simple export and import operations. The 'az keyvault certificate backup' command generates a protected binary backup file, and 'az keyvault certificate restore' uses that file to restore the certificate (with its versions) into another Key Vault. For more details on certificate backup and restore in Azure Key Vault, see Microsoft's official documentation at https://learn.microsoft.com/azure/key-vault/certificates/best-practices.
- A. Incorrect.
Option 1: Generating a .pem file from the existing Key Vault does not preserve the full version history or metadata associated with the certificate. It only exports the current certificate content, so this alone is not sufficient for a complete restore.
- B. Correct.
Option 2 (Correct): The Azure CLI 'az keyvault certificate backup' command creates a .backup file that includes all versions and related metadata of the certificate from KV-A, making it possible to restore exactly as needed.
- C. Correct.
Option 3 (Correct): The Azure CLI 'az keyvault certificate restore' command applies the .backup file to the new Key Vault (KV-B). This process re-creates the certificate with its entire version history, fulfilling the requirement for a full restore.
- D. Incorrect.
Option 4: Exporting to a .pfx does not retain versioning or key attributes from the original vault. It only provides the active certificate material, thus failing to fully preserve versions.