Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The az keyvault key rotation-policy update command configures both the key's lifetime actions and its expiry period. Using --expiry P365D sets the new versions of the key to expire 365 days after they are created. The syntax Rotate@P180D in the --lifetime-actions parameter tells Azure Key Vault to automatically create a new key version 180 days after the current version is created, satisfying the rotation requirement. The Notify action in the second option would only send an event and would not create a new key version. The third option calls a different CLI command that does not configure the rotation policy, and the fourth option uses invalid parameter names and an incorrect sub-command, so neither would apply the required policy.