nerdexam
Microsoft

AZ-500 · Question #406

You have an Azure key vault named Vault1 that stores the resources shown in following table. Which resources support the creation of a rotation policy?

The correct answer is C. Key1 and Secret1 only. Azure Key Vault supports the creation of rotation policies for both cryptographic keys and certain types of secrets, but not for certificates in the same manner.

Submitted by andreas_gr· Mar 6, 2026Secure compute, storage, and databases

Question

You have an Azure key vault named Vault1 that stores the resources shown in following table. Which resources support the creation of a rotation policy?

Options

  • AKey1 Only
  • BCert1 only
  • CKey1 and Secret1 only
  • DKey1 and Cert1 only
  • ESecret1 and Cert1 only
  • FKey1, Secret1, and Cert1

How the community answered

(44 responses)
  • B
    2% (1)
  • C
    89% (39)
  • D
    2% (1)
  • E
    7% (3)

Why each option

Azure Key Vault supports the creation of rotation policies for both cryptographic keys and certain types of secrets, but not for certificates in the same manner.

AKey1 Only

While Key1 (keys) supports rotation policies, Secret1 (secrets) also supports them, making this choice incomplete.

BCert1 only

Certificates in Azure Key Vault have a renewal process, but they do not support the 'rotation policy' feature that applies to keys and secrets for generating new versions or updating credentials.

CKey1 and Secret1 onlyCorrect

Azure Key Vault supports rotation policies for keys, which automate the generation of new key versions at a specified interval. It also supports rotation policies for secrets, particularly those used as credentials for services like Azure Storage accounts, ensuring these secrets are automatically updated and rotated.

DKey1 and Cert1 only

Certificates do not support the 'rotation policy' feature; they have their own lifecycle management for renewal.

ESecret1 and Cert1 only

While Secret1 (secrets) supports rotation policies, Key1 (keys) also supports them, making this choice incomplete; certificates do not support rotation policies.

FKey1, Secret1, and Cert1

Certificates do not support the 'rotation policy' feature in the same way keys and secrets do; they are managed through a separate renewal mechanism.

Concept tested: Azure Key Vault key and secret rotation policies

Source: https://learn.microsoft.com/azure/key-vault/keys/how-to-configure-key-rotation

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice