AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive data in Azure Blob Storage. They want to encrypt the data at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want the key to be automatically rotated every 90 days without manual intervention. Which configuration should they implement?
⚠ Common exam trap
Many candidates confuse where the rotation policy is configured—thinking it is on the storage account (Option A) rather than in Azure Key Vault, or they assume platform-managed keys can be scheduled for rotation (Option D), which is not supported.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.
Azure Key Vault supports automatic key rotation through a rotation policy, which can be configured to rotate a customer-managed key (CMK) every 90 days without manual intervention. When Azure Storage encryption uses a CMK stored in Key Vault, the storage account references the key version, and enabling a rotation policy in Key Vault automatically creates new key versions, which Azure Storage then uses for encryption. This satisfies the requirement for automated 90-day rotation without manual steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Azure Storage encryption with a CMK and configure a rotation policy on the storage account.
Why it's wrong here
Azure Storage itself has no key rotation policy—rotation is a property of the Azure Key Vault where the customer-managed key (CMK) is stored. To meet the automatic rotation requirement, you must create a rotation policy on the Key Vault key, not on the storage account. The storage account only references the key URI, so configuring any rotation policy there is technically invalid and would not cause key versions to update.
- ✓
Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.
Why this is correct
This is correct because with a customer-managed key (CMK) in Azure Key Vault, you can define a key rotation policy that automatically generates new key versions on a schedule. The storage account must reference the key URI without a specific version so it automatically uses the latest key version. This provides the required automatic rotation of the encryption key, fully managed through Azure Key Vault, without manual intervention.
- ✗
Enable Azure Storage encryption with a CMK and manually rotate the key every 90 days.
Why it's wrong here
Manual rotation every 90 days is not automatic and requires human effort to generate a new key version, update the storage account to reference it, and verify the change. The requirement explicitly asks for automatic rotation, so a manual cadence fails that criterion even if it is periodic. Furthermore, manual rotation is error-prone and does not leverage Azure Key Vault's built-in rotation policy, which would provide a governed, auditable, and automated process.
- ✗
Use Azure Storage service-side encryption with platform-managed keys and enforce rotation via Azure Policy.
Why it's wrong here
Platform-managed keys (PMK) are transparently managed by Microsoft and cannot be rotated on a schedule by the customer; Azure Policy can only audit or enforce the use of customer-managed keys, not rotate PMKs. The requirement to control key rotation mandates a customer-managed key (CMK), which PMK does not provide. Enabling service-side encryption with PMK and an Azure Policy would not satisfy the need for a customer-controlled, automatically rotated encryption key.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.