Exam AZ-500 topic 3 question 64 discussion

Azure Buil-t-in policy name: Keys should not be active for longer than the specified number of day Description: Specify the number of days that a key should be active. Keys that are used for an extended period of time increase the probability that an attacker could compromise the key. As a good security practice, make sure that your keys have not been active longer than two years. Reference Azure Policy built-in definitions for Key Vault https://learn.microsoft.com/en-us/azure/key-vault/policy-reference

I've checked the key vault properties and have not found anything about the maximum number of days for which new keys are valid.

D is the answer. https://learn.microsoft.com/en-us/azure/key-vault/general/azure-policy#lifecycle-of-keys With lifecycle management built-ins you can flag or block keys that do not have an expiration date, get alerts whenever delays in key rotation may result in an outage, prevent the creation of new keys that are close to their expiration date, limit the lifetime and active status of keys to drive key rotation, and preventing keys from being active for more than a specified number of days.

answer is B, key vault properties

D. Azure Policy

https://learn.microsoft.com/en-us/azure/key-vault/general/azure-policy?tabs=certificates You want to improve the security posture of your company by implementing requirements around minimum key sizes and maximum validity periods of certificates in your company's key vaults but you don't know which teams will be compliant and which are not. Manage certificates that are within a specified number of days of expiration Your service can experience an outage if a certificate that is not being adequately monitored is not rotated prior to its expiration. This policy is critical to making sure that your certificates stored in key vault are being monitored. It is recommended that you apply this policy multiple times with different expiration thresholds, for example, at 180, 90, 60, and 30-day thresholds. This policy can be used to monitor and triage certificate expiration in your organization.