nerdexam
Microsoft

AZ-500 · Question #249

There is a web application being developed by your company. The app requires API access to a general purpose v2 storage account in Azure. You want to regenerate the access keys from the storage…

The correct answer is A. Configure Azure Key Vault to store access keys for the storage account. To securely manage and schedule the regeneration of storage account access keys for a web application, Azure Key Vault should be used.

Submitted by ashley.k· Mar 6, 2026Secure identity and access

Question

There is a web application being developed by your company. The app requires API access to a general purpose v2 storage account in Azure. You want to regenerate the access keys from the storage account on a schedule. What would be your step of action?

Options

  • AConfigure Azure Key Vault to store access keys for the storage account.
  • BEnable hierarchical namespace for the storage account
  • CImplement storage service encryption for the storage account.
  • DEnforce secure transfer for the storage account.

How the community answered

(58 responses)
  • A
    79% (46)
  • B
    12% (7)
  • C
    5% (3)
  • D
    3% (2)

Why each option

To securely manage and schedule the regeneration of storage account access keys for a web application, Azure Key Vault should be used.

AConfigure Azure Key Vault to store access keys for the storage account.Correct

Azure Key Vault provides a secure way to store and manage sensitive information like storage account access keys. It allows for automated key rotation and integration with applications, enabling scheduled regeneration of storage account keys without embedding them directly into application code.

BEnable hierarchical namespace for the storage account

Enabling hierarchical namespace is a feature for Azure Data Lake Storage Gen2, primarily for file system performance and doesn't directly address key management or rotation.

CImplement storage service encryption for the storage account.

Implementing storage service encryption (SSE) protects data at rest within the storage account but does not manage the access keys used for authentication.

DEnforce secure transfer for the storage account.

Enforcing secure transfer ensures that all requests to the storage account are made over HTTPS, enhancing data in-transit security, but it does not manage or regenerate access keys.

Concept tested: Storage account key management and rotation with Key Vault

Source: https://learn.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice