An inlet-tide gate rotates BusConnection in Key Vault while a still-warming instance may need the previous version. What should the developer understand about secret addressing?
Select an answer to reveal the explanation.
Short Explanation
Rotation is not amnesia—secrets keep versions. Point at current or at a specific version so a lagging host can finish warming on the old BusConnection while new hosts take the latest.
Full Explanation
Key Vault secrets are versioned. When the inlet-tide gate rotates BusConnection, prior versions remain addressable for a time so a still-warming instance can finish on the previous connection string while new hosts take the current version. Code may request the current version (omit version or use latest) or pin a specific version URI as the developer contract during staged rollout.
Believing the vault stores only one immutable value and that rotation always deletes history fails how Key Vault versions work—rotation creates a new version rather than erasing operational memory by default. Claiming versions are unused on AZ-204 and only Azure Front Door can version secrets invents a false product boundary; Front Door is unrelated to Key Vault secret versioning. Assuming every GetSecret without a version randomly picks any historical value fails the actual contract: omitting the version resolves to the current version, not a random historical draw.
Exam caveat: applications that cache secret values must decide whether to pin versions or refresh current on a schedule so rotation does not break long-lived processes mid-flight. Operational check: create a new BusConnection version, point half the gate hosts at current and leave one warming host on the prior version URI, confirm both connect successfully, then retire the old version only after the lagging host recycles.