The answer is that the key vault access policy does not grant the Cosmos DB account necessary permissions on the new key version. When customer-managed key automatic rotation is configured, Azure Key Vault creates a new key version, and Cosmos DB must have the get, wrap, and unwrap permissions on that specific version to continue encrypting and decrypting data at rest. Without these permissions, the service returns 403 Forbidden errors because it cannot access the current encryption key. This scenario directly tests your understanding of the Azure Cosmos DB customer-managed key automatic rotation troubleshooting workflow on the AZ-500 exam, where a common trap is assuming private endpoints or firewall rules cause the error. In reality, private endpoints restrict network traffic, not key access, and Cosmos DB does not require manual key version updates. Remember the mnemonic: “New key, new perms” — every rotation demands explicit access for the new version.
AZ-500 Secure compute, storage, and databases Practice Question
This AZ-500 practice question tests your understanding of secure compute, storage, and databases. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You work for a financial institution that uses Azure Cosmos DB with API for NoSQL to store transaction data. The security requirements mandate: (1) All data at rest must be encrypted using customer-managed keys (CMK) stored in Azure Key Vault. (2) The encryption keys must be automatically rotated every 60 days. (3) Network access to the Cosmos DB account must be restricted to only specific virtual networks. (4) Access to the keys must be logged and monitored. (5) The Cosmos DB account must be configured to use private endpoints. You have configured the Cosmos DB account with CMK and private endpoints. However, after setting up automatic key rotation in Key Vault, the Cosmos DB account starts returning 403 (Forbidden) errors for some requests. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The key vault access policy does not grant the Cosmos DB account necessary permissions on the new key version.
Option D is correct because when using CMK with automatic key rotation, the Cosmos DB account must have access to the new key version. If the account does not have the correct permissions (e.g., get, wrap, unwrap) on the new key version, it will fail. Option A is wrong because private endpoints do not cause 403 errors. Option B is wrong because firewall rules are separate from CMK. Option C is wrong because Cosmos DB does not have a 'key version' property to update manually.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The private endpoint connection is not approved.
Why it's wrong here
Unapproved private endpoints would cause connectivity issues, not 403.
✓
The key vault access policy does not grant the Cosmos DB account necessary permissions on the new key version.
Why this is correct
Cosmos DB needs permissions on each key version when rotation occurs.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The Cosmos DB account's key version property is outdated and must be updated manually.
Why it's wrong here
Cosmos DB automatically uses the latest key version.
✗
The firewall rules are blocking the Cosmos DB account from accessing Key Vault.
Why it's wrong here
Firewall rules apply to client access, not service-to-service.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.
TExam Day Tips
→Underline the problem statement mentally.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Identify which AZ-500 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Secure compute, storage, and databases — This question tests Secure compute, storage, and databases — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The key vault access policy does not grant the Cosmos DB account necessary permissions on the new key version. — Option D is correct because when using CMK with automatic key rotation, the Cosmos DB account must have access to the new key version. If the account does not have the correct permissions (e.g., get, wrap, unwrap) on the new key version, it will fail. Option A is wrong because private endpoints do not cause 403 errors. Option B is wrong because firewall rules are separate from CMK. Option C is wrong because Cosmos DB does not have a 'key version' property to update manually.
What should I do if I get this AZ-500 question wrong?
Identify which AZ-500 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Azure Cosmos DB with API for MongoDB. You need to encrypt data at rest using a customer-managed key stored in Azure Key Vault, and you must ensure that the key is automatically rotated every year. What should you do?
hard
A.Enable server-side encryption with Microsoft-managed keys.
✓ B.Configure a customer-managed key in Key Vault and set the key rotation policy to auto-rotate annually.
C.Use a customer-managed key and manually rotate it every year.
D.Enable infrastructure encryption on the Cosmos DB account.
Why B: Cosmos DB supports customer-managed keys with automatic rotation in Key Vault. Option A is wrong because Cosmos DB does not have infrastructure encryption. Option B is wrong because CMK with manual rotation does not meet automatic requirement. Option D is wrong because Microsoft-managed keys do not allow customer control.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.