A Key Vault certificate and a storage customer-managed key are nearing expiry. How should the security engineer reduce break-glass surprises for callers?
Select an answer to reveal the explanation.
Short Explanation
Don’t wait for the app to face-plant on an expired CMK. Hook expiry and rotation events—Event Grid is the usual megaphone—and automate rotation so callers slide onto the new version.
Full Explanation
Near-expiry certificates and customer-managed keys should trigger automation before callers break. Key Vault emits expiry and rotation-related events; Event Grid is the documented notification integration path when configured, allowing Logic Apps, Functions, or operational tooling to rotate and redistribute. Pairing those events with automated rotation lets canal services pick up new versions instead of failing at hard expiry.
Waiting until applications fail and then pasting new material into source control fails by concept: it is reactive break-glass, not governed lifecycle. Turning off certificate and key expiry attributes so nothing can expire fails compliance and removes the forcing function for rotation. Exporting private keys to a shared desktop folder as the primary notification channel fails confidentiality and is not an eventing architecture.
Exam caveat: events notify—you still need automation or runbooks that create/import new versions and update dependents. Operational check: enable Key Vault event delivery to Event Grid, subscribe a handler for near-expiry/rotation events, test with a short-lived lab certificate or key, confirm notifications fire, and complete automated rotation before production canal-app expiry.