Key rotation concepts in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a new key version for rotation in Azure Key Vault.

Azure

client = KeyClient(vault_url, credential)
new_key = client.create_key("myKey", [1])

Drag options to blanks, or click blank then click option'

AKeyType.RSA

BKeyType.secret

CKeyType.certificate

DKeyType.storage

Attempts:

3 left

💡 Hint

Common Mistakes

Using KeyType.secret instead of KeyType.RSA

Confusing key types with certificates

To create a new key version for rotation, you specify the key type as RSA in Azure Key Vault.

2fill in blank

medium

Complete the code to retrieve the latest version of a key for rotation.

Azure

key = client.get_key("myKey", [1])

Drag options to blanks, or click blank then click option'

Aversion='newest'

Bversion='latest'

Cversion='current'

Dversion=None

Attempts:

3 left

💡 Hint

Common Mistakes

Using a string like 'latest' instead of None

Confusing version parameter with key name

Passing None as the version retrieves the latest version of the key in Azure Key Vault.

3fill in blank

hard

Fix the error in the code to schedule key rotation policy correctly.

Azure

rotation_policy = KeyRotationPolicy(lifetime_actions=[[1]])

Drag options to blanks, or click blank then click option'

ALifetimeAction(action='Rotate', trigger=Trigger(time_after_create='P90D'))

BLifetimeAction(action_type='Rotate', trigger=Trigger(time_after_create=90))

CLifetimeAction(action='rotate', trigger=Trigger(time_after_create='P90D'))

DLifetimeAction(action_type='Rotate', trigger=Trigger(time_after_create='90D'))

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'action_type' instead of 'action'

Passing integer instead of ISO 8601 duration string

The correct parameter name is action and the time format must be ISO 8601 duration like 'P90D'.

4fill in blank

hard

Fill both blanks to set a key rotation policy with expiry and rotation triggers.

Azure

policy = KeyRotationPolicy(lifetime_actions=[LifetimeAction(action=[1], trigger=Trigger(time_before_expiry=[2]))])

Drag options to blanks, or click blank then click option'

A'rotate'

B'notify'

C'P30D'

D'30D'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'rotate' instead of 'notify' for notification

Using '30D' instead of 'P30D' for duration

To notify before expiry, use action='notify' and time_before_expiry='P30D' (ISO 8601 format).

5fill in blank

hard

Fill all three blanks to update the key rotation policy with rotation and notification triggers.

Azure

policy = KeyRotationPolicy(lifetime_actions=[
  LifetimeAction(action=[1], trigger=Trigger(time_after_create=[2])),
  LifetimeAction(action=[3], trigger=Trigger(time_before_expiry='P15D'))
])

Drag options to blanks, or click blank then click option'

A'rotate'

B'notify'

C'P90D'

D'P60D'

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up action types

Using incorrect duration formats

The rotation action uses 'rotate' with a 90-day trigger, and notification uses 'notify' 15 days before expiry.

Practice

1. What is the main purpose of key rotation in Azure Key Vault?

easy

A. To share keys with other users

B. To delete all keys after use

C. To backup keys to local storage

D. To regularly change keys to improve security

Solution

1. Step 1: Understand key rotation purpose

   Key rotation means changing keys regularly to reduce risk if keys are exposed.

2. Step 2: Identify correct purpose in options

   Only To regularly change keys to improve security describes improving security by changing keys regularly.

3. Final Answer:

   To regularly change keys to improve security -> Option D

4. Quick Check:

   Key rotation = improve security by changing keys regularly [OK]

Hint: Key rotation means changing keys often for safety [OK]

Common Mistakes:

• Thinking key rotation deletes keys
• Confusing key rotation with key sharing
• Believing key rotation backs up keys

2. Which Azure CLI command is used to rotate a key in Azure Key Vault?

easy

A. az keyvault key create

B. az keyvault key update

C. az keyvault key rotate

D. az keyvault key delete

Solution

1. Step 1: Recall Azure CLI commands for key management

   To rotate a key, you create a new version using 'az keyvault key create'.

2. Step 2: Match command to rotation action

   'az keyvault key rotate' does not exist; 'create' is correct for rotation.

3. Final Answer:

   az keyvault key create -> Option A

4. Quick Check:

   Rotate key = create new version command [OK]

Hint: Use 'create' command to rotate keys in Azure CLI [OK]

Common Mistakes:

• Using 'update' instead of 'create' for rotation
• Assuming 'rotate' is a valid CLI command
• Confusing 'delete' with rotation

3. Given this Azure CLI command sequence:

az keyvault key create --vault-name MyVault --name MyKey --protection software
az keyvault key update --vault-name MyVault --name MyKey --ops encrypt decrypt sign verify

What is the expected result after running these commands?

medium

A. The key MyKey is deleted from MyVault

B. A new key named MyKey is created and its operations are updated

C. The key MyKey is backed up locally

D. An error occurs because update cannot change operations

Solution

1. Step 1: Analyze the create command

   The first command creates a key named MyKey in MyVault with software protection.

2. Step 2: Analyze the update command

   The update command changes the key's allowed operations to encrypt, decrypt, sign, and verify.

3. Final Answer:

   A new key named MyKey is created and its operations are updated -> Option B

4. Quick Check:

   Create then update key operations = success [OK]

Hint: Create key first, then update operations to rotate [OK]

Common Mistakes:

• Thinking update deletes the key
• Assuming update backs up the key
• Believing update cannot change operations

4. You try to rotate a key using this command:

az keyvault key rotate --vault-name MyVault --name MyKey

But you get an error saying the command is not found. What is the likely cause?

medium

A. The 'rotate' command does not exist in Azure CLI for keys

B. The vault name is incorrect

C. The key name is missing

D. You need to delete the key before rotating

Solution

1. Step 1: Check Azure CLI command availability

   Azure CLI does not have a 'key rotate' command for Key Vault keys.

2. Step 2: Identify correct rotation method

   Rotation is done by creating a new version or updating the key, not by a rotate command.

3. Final Answer:

   The 'rotate' command does not exist in Azure CLI for keys -> Option A

4. Quick Check:

   No 'rotate' command in Azure CLI keys [OK]

Hint: No 'rotate' command; use update or create new version [OK]

Common Mistakes:

• Assuming 'rotate' command exists
• Blaming vault or key name for syntax errors
• Trying to delete key before rotation

5. You want to automate key rotation in Azure Key Vault without downtime. Which approach is best?

hard

A. Export keys locally and re-import after rotation

B. Delete the old key and create a new key with the same name immediately

C. Create a new key version and update applications to use it before deleting old key

D. Manually update keys once a year during maintenance windows

Solution

1. Step 1: Understand zero downtime rotation

   Creating a new key version allows apps to switch smoothly without service interruption.

2. Step 2: Evaluate options for automation and safety

   Deleting keys immediately causes downtime; manual yearly updates risk security; exporting keys is insecure.

3. Final Answer:

   Create a new key version and update applications to use it before deleting old key -> Option C

4. Quick Check:

   New version + update apps = smooth rotation [OK]

Hint: Use new key version and switch apps before deleting old key [OK]

Common Mistakes:

• Deleting old key before switching
• Relying on manual yearly rotation
• Exporting keys outside Key Vault