AZ-204 Implement Azure security Practice Question
You need to ensure that secrets stored in Azure Key Vault are automatically rotated every 90 days. Which feature should you configure?
⚠ Common exam trap
A common mix-up: candidates assume setting an expiration date (Option C) automatically triggers rotation, but Key Vault only marks the secret as expired—it does not create a new version or notify any service to rotate it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Key Vault secret rotation with Event Grid and Azure Functions
Azure Key Vault does not natively rotate secrets automatically. To achieve automatic rotation every 90 days, you must integrate Key Vault with Event Grid to detect secret expiration events and trigger an Azure Function that generates a new secret version and updates the expiration date. This pattern is the recommended solution for automated secret rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set an access policy for the secret
Why it's wrong here
Setting an access policy for a secret defines which identities (users, applications, or managed identities) have specific permissions, such as `get`, `list`, or `set`, on that secret within the Key Vault. While crucial for securing access to the secret, access policies are purely about authorization and do not provide any mechanism to automatically generate new secret values or trigger a rotation process. They control *who* can perform operations, not *what* automated operations occur.
- ✗
Enable soft delete and purge protection
Why it's wrong here
Enabling soft delete and purge protection are critical data protection features for Azure Key Vault. Soft delete retains deleted secrets for a specified period, allowing recovery and preventing accidental permanent data loss, while purge protection prevents immediate and irreversible deletion even by privileged users. These features safeguard the *availability* and *recoverability* of the secret object itself, but they do not contribute to or initiate the automatic modification or rotation of the secret's underlying value.
- ✗
Set a secret expiration date
Why it's wrong here
Setting a secret expiration date in Azure Key Vault marks the secret as expired after a specific timestamp, which can be used for lifecycle management and to trigger notifications via Azure Event Grid. However, this action only changes the secret's status and does not automatically generate a new secret value, update the existing secret in Key Vault, or propagate the new value to consuming applications. It serves as a reminder or a flag, not an automated rotation mechanism.
- ✓
Use Key Vault secret rotation with Event Grid and Azure Functions
Why this is correct
The recommended approach for automated secret rotation involves leveraging Azure Key Vault's ability to publish events to Azure Event Grid when a secret is nearing expiration or when a rotation policy is triggered. An Azure Function can then subscribe to these Event Grid events, execute custom logic to generate a new secret value, update the secret in Key Vault, and potentially update the consuming application's configuration. This event-driven architecture provides a robust and extensible solution for proactive secret management.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.