Canal-app password rotation will land a new value in Key Vault. How should the security engineer stage the change?
Select an answer to reveal the explanation.
Short Explanation
Rotate by adding a new version, not by torching the only copy. Leave the old version around until every canal-app instance has moved to the current one.
Full Explanation
Key Vault secrets and keys are versioned. Creating a new version lets applications adopt the current version while earlier versions remain retrievable during rollout. Overwriting or deleting the sole version before callers move causes outages. Distributing plaintext outside Key Vault and randomly renaming secrets both weaken lifecycle control. Versioning is the Key Vault lifecycle primitive AZ-500 expects for rotation staging.