AZ-500 Secure compute, storage, and databases Practice Question
You are the Azure Security Engineer for a healthcare company that stores patient imaging data in an Azure Storage account. The compliance team requires that all data written to the account be encrypted with a customer-managed key stored in Azure Key Vault, and that this key be automatically rotated every 12 months. You configure a customer-managed key for the storage account. Which additional configuration must you apply to meet the automatic rotation requirement?
⚠ Common exam trap
The trap here is assuming that Azure Storage provides a built-in key rotation interval setting, when rotation must actually be configured on the Key Vault key itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In Azure Key Vault, configure a key rotation policy on the customer-managed key that rotates the key every 12 months.
Customer-managed keys for Azure Storage encryption are stored in Azure Key Vault. To automatically rotate the key, you configure a rotation policy on the key itself in Key Vault. The storage account should reference the key without a specific version so that it always uses the latest key version. This native integration ensures seamless rotation without manual intervention or custom scripting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an Azure Automation runbook that updates the storage account encryption key version every 12 months.
Why it's wrong here
While an Automation runbook could be scripted to update the key version, this is a manual, custom solution that introduces operational overhead and potential failure points. It is not the native, supported mechanism for automatic rotation. The requirement is best met by using Key Vault's built-in rotation policy rather than a custom runbook.
- ✗
Enable Azure Defender for Storage and set the key rotation period in the Defender for Cloud security policy.
Why it's wrong here
Azure Defender for Storage provides threat detection and security alerts for storage accounts, but it does not manage encryption key rotation. The security policy in Defender for Cloud cannot enforce or perform key rotation. This option misattributes key management capabilities to a security monitoring service and would not achieve the required rotation.
- ✓
In Azure Key Vault, configure a key rotation policy on the customer-managed key that rotates the key every 12 months.
Why this is correct
Azure Key Vault supports key rotation policies that automatically generate a new key version on a schedule. When the storage account references the key without a specific version, it will automatically use the latest version, so rotating the key in Key Vault every 12 months meets the requirement. This is the supported and recommended approach for automatic key rotation.
- ✗
In the storage account's encryption settings, set the key rotation interval to 12 months and enable auto-rotation.
Why it's wrong here
Azure Storage account encryption settings do not provide a built-in key rotation interval or auto-rotation toggle for customer-managed keys. Rotation must be managed externally, such as through the key's own rotation policy in Key Vault. Configuring such an interval in the storage account is not a supported feature and will not satisfy the requirement.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.