AZ-500 · Question #406
You have an Azure key vault named Vault1 that stores the resources shown in following table. Which resources support the creation of a rotation policy?
The correct answer is C. Key1 and Secret1 only. Azure Key Vault supports the creation of rotation policies for both cryptographic keys and certain types of secrets, but not for certificates in the same manner.
Question
Options
- AKey1 Only
- BCert1 only
- CKey1 and Secret1 only
- DKey1 and Cert1 only
- ESecret1 and Cert1 only
- FKey1, Secret1, and Cert1
How the community answered
(44 responses)- B2% (1)
- C89% (39)
- D2% (1)
- E7% (3)
Why each option
Azure Key Vault supports the creation of rotation policies for both cryptographic keys and certain types of secrets, but not for certificates in the same manner.
While Key1 (keys) supports rotation policies, Secret1 (secrets) also supports them, making this choice incomplete.
Certificates in Azure Key Vault have a renewal process, but they do not support the 'rotation policy' feature that applies to keys and secrets for generating new versions or updating credentials.
Azure Key Vault supports rotation policies for keys, which automate the generation of new key versions at a specified interval. It also supports rotation policies for secrets, particularly those used as credentials for services like Azure Storage accounts, ensuring these secrets are automatically updated and rotated.
Certificates do not support the 'rotation policy' feature; they have their own lifecycle management for renewal.
While Secret1 (secrets) supports rotation policies, Key1 (keys) also supports them, making this choice incomplete; certificates do not support rotation policies.
Certificates do not support the 'rotation policy' feature in the same way keys and secrets do; they are managed through a separate renewal mechanism.
Concept tested: Azure Key Vault key and secret rotation policies
Source: https://learn.microsoft.com/azure/key-vault/keys/how-to-configure-key-rotation
Community Discussion
No community discussion yet for this question.