AZ-204 Implement Azure security Practice Question
Your company uses Azure Key Vault to manage encryption keys for data at rest in Azure Storage. You need to ensure that the storage account uses a customer-managed key (CMK) stored in Key Vault. Additionally, you need to periodically rotate the key automatically. Which configuration should you implement?
⚠ Common exam trap
Many exam-takers confuse enabling soft-delete/purge protection (which is required for CMK but does not enable rotation) with the actual rotation policy configuration, or they assume that system-managed keys can be used when the question explicitly requires a customer-managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a key in Key Vault, assign the storage account's managed identity access to that key, and configure a Key Vault rotation policy to automatically rotate the key regularly
It combines the three essential elements for using a customer-managed key (CMK) with automatic rotation in Azure Key Vault. First, you must create a key in Key Vault (not use the default system-managed key). Second, the storage account's managed identity must be granted 'Get', 'Unwrap Key', and 'Wrap Key' permissions on that key so it can encrypt/decrypt the storage account's root key. Third, you configure a Key Vault rotation policy (using the Azure Key Vault key rotation feature) to automatically create new key versions on a schedule (e.g., every 90 days), which the storage account automatically picks up without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a key in Key Vault, assign the storage account's managed identity access to that key, and configure a Key Vault rotation policy to automatically rotate the key regularly
Why this is correct
This option correctly outlines the steps for implementing customer-managed keys with automatic rotation. Creating a key in Key Vault establishes customer ownership, while assigning the storage account's managed identity provides secure, credential-less access to the key. Crucially, configuring a Key Vault key rotation policy automates the generation of new key versions according to a defined schedule, ensuring compliance with the 'automatically rotate' requirement without manual intervention.
- ✗
Enable soft-delete and purge protection on the Key Vault to allow key recovery during rotation
Why it's wrong here
Enabling soft-delete and purge protection on a Key Vault is a critical security measure that prevents permanent data loss by allowing recovery of deleted keys and vaults. However, these features are focused on data retention and recovery, not on the active management or rotation of cryptographic keys. They do not initiate, schedule, or perform the process of generating new key versions or updating services to use them, thus failing to meet the requirement for automatic key rotation.
- ✗
Use Azure Key Vault's default key (system-managed) and rely on built-in rotation
Why it's wrong here
Azure Key Vault does not offer a 'default key' that is system-managed for customer-facing services like storage accounts when the requirement is for customer-managed keys. While Azure services can use platform-managed keys where Azure handles all key lifecycle operations, the question specifically implies a need for customer control over the keys. Relying on a non-existent system-managed key or Azure's internal key management for platform-managed keys would contradict the explicit requirement for customer-managed keys.
- ✗
Manually rotate the key every 90 days by generating a new version and updating the storage account
Why it's wrong here
Manually rotating keys involves an administrator periodically generating a new key version in Key Vault and then manually updating the associated service, such as a storage account, to use this new version. While this process achieves key rotation, it is a manual operational task that does not satisfy the requirement for *automatic* key rotation. Azure Key Vault's key rotation policy feature is specifically designed to automate this entire lifecycle, eliminating the need for human intervention and ensuring consistent adherence to rotation schedules.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.