You have an Azure subscription that contains a storage account named storage1. You need to ensure that the access keys for storage1 rotate automatically. What should you configure?

Azure Key Vault is the designated service for securely managing secrets, keys, and certificates. It provides a feature to manage Azure Storage account access keys. By configuring Key Vault to manage a storage account, you can set a rotation policy to automatically regenerate (rotate) the access keys at a specified frequency. This enhances security by ensuring that keys are changed regularly without manual intervention, reducing the risk associated with long-lived static credentials. Key Vault handles the entire lifecycle of the keys once configured.

A. a backup vault: This is a component of Azure Backup used to store and manage backup data, not for rotating storage account keys.
B. redundancy for storage1: This setting (e.g., LRS, GRS, ZRS) relates to data durability and availability strategies, not credential management.
C. lifecycle management for storage1: This feature automates the tiering and deletion of blobs based on rules, not the rotation of access keys.
E. a Recovery Services vault: This is a management entity for Azure Backup and Azure Site Recovery services, unrelated to storage key management.

1. Microsoft Learn. (2023). Automate the rotation of storage account keys in Key Vault. In "Azure Key Vault documentation". The document states, "Azure Key Vault can manage your storage account keys... You can also have Key Vault automatically regenerate (rotate) the keys periodically."

2. Microsoft Learn. (2023). Manage storage account keys with Key Vault and the Azure CLI. In "Azure Key Vault documentation". This tutorial details the process, including the step to "Set a key rotation period."

3. Microsoft Learn. (2023). What is Azure Key Vault?. In "Azure Key Vault documentation". Under the "Why use Azure Key Vault?" section, it lists "Secrets Management," which includes managing tokens, passwords, certificates, API keys, and other secrets, such as storage account keys.