This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Answer the following questions to check your understanding of managing keys and secrets in Azure Key Vault.
A regulatory compliance assessment requires that encryption keys protecting patient record archives meet FIPS 140-3 Level 3 hardware security requirements. Which Azure Key Vault configuration satisfies this requirement?
Create RSA keys in an Azure Key Vault Standard vault with software protection.
Enable purge protection on an Azure Key Vault Standard vault.
Create RSA-HSM keys in an Azure Key Vault Premium vault.
Import keys using BYOK into an Azure Key Vault Standard vault.
A security engineer configures an autorotation policy for an RSA encryption key in Azure Key Vault. What happens to data that was encrypted with the previous key version after rotation occurs?
Previously encrypted data becomes permanently inaccessible and must be re-encrypted before rotation.
Previously encrypted data remains accessible because Key Vault retains all key versions.
Azure automatically re-encrypts all existing data with the new key version during rotation.
Key autorotation requires application downtime to update key version references.
An Azure Function uses a database connection string stored as a Key Vault secret. A security engineer wants to rotate the connection string without causing application downtime. What rotation pattern should they use?
Single-credential rotation with immediate atomic secret update.
Key autorotation policy configured on an RSA key.
Certificate autorenewal with an integrated CA issuer.
Dual-credential rotation using two alternating valid connection strings.
You must answer all questions before checking your work.
Was this page helpful?
Need help with this topic?
Want to try using Ask Learn to clarify or guide you through this topic?