AZ-204 Certification Practice Question #154

Question

You are developing several microservices to deploy to a new Azure Kubernetes Service cluster. The microservices manage data stored in Azure Cosmos DB and Azure Blob storage. The data is secured by using customer-managed keys stored in Azure Key Vault.

You must automate key rotation for all Azure Key Vault keys and allow for manual key rotation. Keys must rotate every three months. Notifications of expiring keys must be sent before key expiry.

You need to configure key rotation and enable key expiry notifications.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

This question has a genuine community split between AD (34 votes) and BD (significant minority). D (key rotation policy) is unambiguously correct — it directly configures the 3-month automated rotation requirement. The split is about whether A (create Event Grid instance) or B (configure KV alerts) handles expiry notifications. MS Learn's Event Grid tutorial explicitly states "When one of the secrets in the key vault is about to expire…Event Grid is notified of the status change." Azure Monitor/KV Alerts, per MS documentation, are designed for operational health monitoring (too many errors, throttling), not expiry event notifications. While KV does have built-in Event Grid integration, the exam question uses "Create and configure a new Azure Event Grid instance" to mean setting up the subscription/handler for those expiry events. The 34-vote majority and MS Learn evidence favor AD over BD, but the minority BD view is defensible, keeping confidence at 77%.

More AZ-204 practice questions