nerdexam
Microsoft

AZ-500 · Question #244

You are working for an organization as an Azure administrator. The keys for Azure Service Bus are stored and accessed by Azure Key Vault used by several applications that organization is using. The…

The correct answer is D. Use an Automation account and a runbook to rotate keys. To automatically rotate Azure Service Bus keys stored in Azure Key Vault, create an Azure Automation account with a runbook that programmatically handles the key regeneration in Service Bus and updates the Key Vault secret.

Submitted by obi.ng· Mar 6, 2026Secure identity and access

Question

You are working for an organization as an Azure administrator. The keys for Azure Service Bus are stored and accessed by Azure Key Vault used by several applications that organization is using. The keys are manually regenerated and stored in the key vault and this process is a little time taking. What would be your step of action if you want to configure Azure to rotate the keys automatically?

Options

  • ASet the keys to auto rotate with an expiration date of 6 months.
  • BUse a scheduled task and PowerShell to expire the keys and generate new ones.
  • CGrant each application permission to rotate the keys.
  • DUse an Automation account and a runbook to rotate keys.

How the community answered

(36 responses)
  • A
    14% (5)
  • B
    3% (1)
  • C
    8% (3)
  • D
    75% (27)

Why each option

To automatically rotate Azure Service Bus keys stored in Azure Key Vault, create an Azure Automation account with a runbook that programmatically handles the key regeneration in Service Bus and updates the Key Vault secret.

ASet the keys to auto rotate with an expiration date of 6 months.

Setting an expiration date on a Key Vault secret only marks it as expired; it does not automatically trigger the regeneration of the Service Bus key or update the secret with a new value.

BUse a scheduled task and PowerShell to expire the keys and generate new ones.

A scheduled task is an on-premises concept; in Azure, an Automation account with a scheduled runbook provides the cloud-native equivalent for automating tasks.

CGrant each application permission to rotate the keys.

Granting applications permission to rotate keys would delegate this sensitive task to potentially multiple applications, which is not a secure or centralized approach for managing key rotation.

DUse an Automation account and a runbook to rotate keys.Correct

Azure Automation with a PowerShell runbook is the recommended and most common solution for orchestrating automated tasks like regenerating keys for Azure services (like Service Bus) and then updating the corresponding secrets in Azure Key Vault.

Concept tested: Automated key rotation using Azure Automation and Key Vault

Source: https://learn.microsoft.com/en-us/azure/key-vault/secrets/tutorial-rotation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice