AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure Disk Encryption (ADE) on Windows virtual machines. They use a key encryption key (KEK) stored in Azure Key Vault to wrap the disk encryption key. The security policy requires that the KEK be automatically rotated every 90 days. They need to ensure that after rotation, the OS and data disks of running VMs automatically get re-wrapped with the new KEK version. Which configuration should they implement?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy (which enforces compliance) with actual key rotation and re-wrapping mechanisms, or mistakenly believe that manual key version updates in the DES are sufficient for automatic re-wrapping of running VMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).
Azure Key Vault supports automatic key rotation with a configurable rotation period, and when a disk encryption set (DES) is configured with an empty string as the key version, it automatically uses the latest version of the KEK. This ensures that after the KEK is rotated every 90 days, the running VMs' OS and data disks are re-wrapped with the new KEK version without manual intervention or VM restart.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable soft-delete and purge protection on the Key Vault.
Why it's wrong here
Soft-delete and purge protection are Key Vault durability features that prevent accidental or malicious deletion of keys and allow recovery within a retention period. They do not introduce any key lifecycle automation: without a rotation policy and a disk encryption set configured with a blank key version, the KEK remains static and disk re-wrapping never occurs. Thus, enabling these features only safeguards the existing key material, not the 90-day automatic rotation the scenario requires.
- ✓
Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).
Why this is correct
Key Vault key auto-rotation creates new key versions on schedule. By setting the key version to empty in the disk encryption set, the VMs automatically re-wrap their disks with the latest key version after rotation.
- ✗
Create a new KEK every 90 days and modify the disk encryption set to point to the new key version.
Why it's wrong here
Manually creating a new KEK every 90 days and pointing the disk encryption set to that new key version does not trigger re-wrapping of existing disks. The VM's encryption settings reference the disk encryption set, but unless the set's key URI includes an empty key version to signal 'use current latest,' the old key version continues to be used until a restart or explicit update of the VM's encryption settings forces re-encryption. This is a manual, error-prone workflow, not the automatic re-wrap the design requires.
- ✗
Use Azure Policy to enforce automatic key rotation.
Why it's wrong here
Azure Policy can audit or enforce that VMs use a specific key version, but it does not cause automatic re-wrapping after key rotation. The disk encryption set must be configured to use the latest key version.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.