AZ-204 Implement Azure security Practice Question
Your application uses Azure Key Vault to store cryptographic keys. You need to ensure that keys are automatically rotated every 90 days without any manual intervention. Which Key Vault feature should you configure?
⚠ Common exam trap
Candidates often confuse soft-delete or Managed HSM with rotation capabilities, but neither feature automates key version creation; only a rotation policy does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a key rotation policy
Azure Key Vault supports key rotation policies that allow you to define automatic rotation intervals (e.g., every 90 days) for cryptographic keys. When a rotation policy is set, Key Vault automatically creates a new key version and optionally expires the old one, eliminating the need for manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set a key rotation policy
Why this is correct
Setting a key rotation policy in Azure Key Vault is the correct approach because it automates the generation of new cryptographic key versions based on a predefined schedule or an expiry notification. This feature ensures that keys are regularly updated without manual intervention, significantly enhancing security by limiting the lifespan of any single key. Automated rotation is a critical security best practice for managing the lifecycle of cryptographic assets and mitigating risks associated with long-lived keys.
- ✗
Configure a Key Vault firewall
Why it's wrong here
Configuring a Key Vault firewall restricts network access to the vault, allowing only specified IP addresses, virtual networks, or private endpoints to establish connections. While crucial for establishing a secure network perimeter and protecting the vault from unauthorized external access, a firewall does not manage or automate the internal lifecycle of cryptographic keys stored within the vault. Its function is solely focused on network-level access control, not key rotation.
- ✗
Enable soft-delete on the key vault
Why it's wrong here
Enabling soft-delete on an Azure Key Vault provides a recovery mechanism for accidentally or maliciously deleted keys, secrets, or certificates. When soft-delete is active, deleted items are retained for a configurable period, allowing administrators to restore them if needed, thus preventing permanent data loss. However, this feature is focused on data resilience and recovery, and it does not facilitate or automate the process of generating new versions of existing cryptographic keys for rotation purposes.
- ✗
Use a managed HSM instead of a standard vault
Why it's wrong here
Azure Key Vault Managed HSM (Hardware Security Module) offers a higher level of FIPS 140-2 Level 3 validated hardware-backed security for cryptographic keys, and it does support key rotation policies. However, the question implies the application uses a standard Azure Key Vault. Migrating from a standard vault to a Managed HSM is a significant architectural change and not a feature *within* a standard Key Vault to achieve key rotation; standard Key Vaults themselves offer key rotation policies.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.