Design and Implement a Strategy for Managing Sensitive Information in Automation AZ-400 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   Your application uses customer-managed keys for encryption. You need to rotate these keys automatically every 90 days without manual intervention. Which Key Vault feature should you enable?

   • AEnable key rotation policy on the Key Vault key.
   • BUse a certificate with auto-renewal to replace the key.
   • CStore the key in a secret and update the secret value periodically.
   • DManually create a new key version every 90 days using a script.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   Your Azure Pipeline needs to use a private certificate to sign an application during the build. The certificate must not be stored in the repository. Which feature should you use?

   • ACommit the certificate to a private Git repository and clone it in the pipeline.
   • BUse a pipeline variable to hold the certificate content.
   • CStore the certificate in a public Azure Storage container and download it in the pipeline.
   • DUpload the certificate as a secure file and use the DownloadSecureFile task to retrieve it during the build.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   Your organization has multiple Azure subscriptions and wants to centralize secret management. You need to ensure that secrets are accessible to applications in different subscriptions while minimizing administrative overhead. Which approach should you use?

   • ACreate a single Key Vault in a central subscription and grant access to applications in other subscriptions using RBAC.
   • BCreate a Key Vault in each subscription and replicate secrets manually.
   • CUse Azure App Configuration to store secrets and access them from any subscription.
   • DUse a Key Vault per application and store secrets in each.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   Your deployment process requires a configuration file that contains sensitive data. You want to ensure the file is not stored in the repository and is only available during the deployment. What should you do?

   • AGenerate the file at runtime using a script that contains the sensitive data.
   • BStore the file in Azure Blob Storage with public access.
   • CCommit the file to a private repository and clone it during the pipeline.
   • DStore the file as a secure file in Azure Pipelines and download it during the pipeline.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a key feature of Azure Key Vault's certificate management?

   • AIt can only store certificates that are manually uploaded and cannot manage their lifecycle.
   • BIt stores certificates in plaintext so they can be easily downloaded by anyone.
   • CIt replaces the need for a public key infrastructure (PKI) entirely.
   • DIt can automatically issue and renew certificates from a supported certificate authority (CA).
   Reveal Solution Discussion Select an answer first