Enforcing 90-Day Automated Secret Rotation with Azure Key Vault
Your team uses GitHub Actions for CI/CD. Security policies require that secrets must be automatically rotated every 90 days. Which Azure DevOps feature should you integrate to enforce this requirement?
Quick Answer
Azure Key Vault's built-in rotation policy feature is designed for exactly this requirement — it lets you configure secrets to automatically rotate on a defined interval, such as every 90 days, without any manual intervention or custom automation, and integrates cleanly with pipelines that already pull secrets from Key Vault.
⚠ Common exam trap
The trap here is that candidates might confuse scheduled workflows in GitHub Actions with automated secret rotation, but GitHub Actions secrets do not support native rotation policies, whereas Azure Key Vault does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault with rotation policy
Azure Key Vault supports automated secret rotation policies that can be configured to rotate secrets at a specified interval, such as every 90 days. By integrating Azure Key Vault with GitHub Actions, you can enforce the security policy that secrets must be automatically rotated without manual intervention. This is the correct choice because it directly meets the requirement for automated rotation within Azure's ecosystem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Microsoft Purview is for data governance and compliance, not secret rotation.
- ✗
GitHub Actions secrets with scheduled workflows
Why it's wrong here
GitHub Actions secrets do not support automatic rotation natively.
- ✓
Azure Key Vault with rotation policy
Why this is correct
Azure Key Vault supports secret rotation policies that can be configured to rotate secrets automatically.
- ✗
Azure Managed Identities
Why it's wrong here
Managed Identities provide authentication, not secret rotation.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses GitHub Actions for CI/CD. You need to ensure that secrets used in workflows are automatically rotated every 90 days. What is the best approach?
hard- A.Use OpenID Connect (OIDC) to authenticate.
- ✓ B.Use a script that calls the GitHub API to update the secret and run it in a scheduled workflow.
- C.Manually update the secrets every 90 days.
- D.Store secrets as environment secrets and configure expiration.
Why B: It uses the GitHub API within a scheduled workflow to programmatically rotate secrets, ensuring automation without manual intervention. This approach directly addresses the requirement for automatic rotation every 90 days by generating new secret values and updating the repository or organization secrets via the API.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.