Hotspot Question You have an Azure subscription that contains an Azure key vault named Vault1. On January 1, 2024, Vault1 stores the following secrets. All dates are in the mm/dd/yy format. When can…

The correct answer is Password1: Never; Password2: From 03/01/24 12:00:00 AM to 05/01/24 12:00:00 AM. This question tests knowledge of Azure Key Vault secret lifecycle management, specifically how activation dates (Not Before) and expiration dates affect secret availability to applications.

Submitted by carter_n· Mar 6, 2026Secure compute, storage, and databases

Question

Hotspot Question You have an Azure subscription that contains an Azure key vault named Vault1. On January 1, 2024, Vault1 stores the following secrets. All dates are in the mm/dd/yy format. When can each secret be used by an application? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibits

Answer Area

Password1Never
NeverAlwaysFrom 01/01/24 12:00:00 AM onwardsFrom 03/01/24 12:00:00 AM onwardsFrom 05/01/24 12:00:00 AM onwardsFrom 03/01/24 12:00:00 AM to 05/01/24 12:00:00 AM
Password2From 03/01/24 12:00:00 AM to 05/01/24 12:00:00 AM
NeverAlwaysFrom 01/01/24 12:00:00 AM onwardsFrom 03/01/24 12:00:00 AM onwardsFrom 05/01/24 12:00:00 AM onwardsFrom 03/01/24 12:00:00 AM to 05/01/24 12:00:00 AM

Explanation

This question tests knowledge of Azure Key Vault secret lifecycle management, specifically how activation dates (Not Before) and expiration dates affect secret availability to applications.

Approach. In Azure Key Vault, a secret has two key date properties that control its usability: 'Activation Date' (nbf - Not Before) and 'Expiration Date' (exp). A secret is only usable by an application when: (1) the current date is ON or AFTER the activation date, AND (2) the current date is BEFORE the expiration date (or no expiration is set). If a secret has no activation date set, it is available immediately from creation. If a secret has no expiration date, it remains available indefinitely after activation. On January 1, 2024, you evaluate each secret by checking whether that date falls within the valid window between its activation date and expiration date to determine if an application can use it.

Concept tested. Azure Key Vault secret availability is controlled by 'Not Before' (activation) and 'Expiration Date' properties. A secret is accessible to applications only during the window between its activation date and expiration date. Secrets outside this window will return an error when accessed, even if they exist in the vault. This is critical for certificate rotation, credential management, and time-bound access scenarios.

Reference. https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets

Topics

#Azure Key Vault#secret management#secret lifecycle#access policies

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice