AZ-204 Implement Azure security Practice Question
A company stores secrets (e.g., connection strings) in Azure Key Vault and needs them automatically rotated every 90 days. Which solution should they implement?
⚠ Common exam trap
Candidates often assume Key Vault has a built-in rotation feature, but Azure Key Vault only stores secrets and requires an external automation trigger (Event Grid + Azure Function) to implement rotation logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Event Grid to trigger an Azure Function or Automation runbook that rotates the secret
Azure Key Vault does not natively support automatic secret rotation; you must implement a custom solution using Event Grid to detect expiration events and trigger an Azure Function or Automation runbook that generates a new secret and updates the vault. This pattern leverages Key Vault's eventing capabilities to automate the rotation workflow without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Key Vault access policies to enforce rotation
Why it's wrong here
Azure Key Vault access policies define granular permissions for principals (users, groups, or service principals) to perform specific operations like 'get', 'list', 'set', or 'delete' on keys, secrets, and certificates. While essential for enforcing the principle of least privilege and controlling who can interact with secrets, these policies are purely for authorization. They do not contain any built-in functionality or configuration to automatically trigger, schedule, or enforce the rotation of secret values based on expiration or a defined schedule.
- ✗
Enable Key Vault firewall to limit access
Why it's wrong here
The Azure Key Vault firewall, often combined with virtual network service endpoints or private endpoints, is a network security feature designed to restrict network access to the Key Vault. It limits connections to specific IP ranges or virtual networks, thereby protecting the vault from unauthorized network access. However, this security control operates at the network layer and has no capability to manage the lifecycle of secrets, nor does it automate the process of generating new secret values or updating existing ones within the vault.
- ✓
Use Event Grid to trigger an Azure Function or Automation runbook that rotates the secret
Why this is correct
This is the recommended and most robust pattern for automating secret rotation. Azure Key Vault integrates with Azure Event Grid, which can publish events such as 'SecretNearExpiry' when a secret is approaching its expiration date. Subscribing to these events allows an Azure Function or an Azure Automation runbook to be automatically triggered. This triggered logic can then programmatically generate a new secret, update it in the Key Vault, and subsequently update any applications or services that consume that secret, providing a fully automated and proactive rotation solution.
- ✗
Enable soft-delete on the vault
Why it's wrong here
Soft-delete in Azure Key Vault is a crucial data protection feature that prevents the immediate and irreversible deletion of vaults or vault objects (keys, secrets, certificates). When enabled, deleted items are retained for a configurable period, allowing for recovery and preventing permanent data loss due to accidental deletions. While vital for business continuity and disaster recovery, soft-delete is entirely focused on data retention and recovery, and it does not provide any mechanism for the proactive management, generation, or automated rotation of secret values within the vault.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.