Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

An organization is configuring a custom domain for a web application. You need to create an SSL/TLS certificate in Azure Key Vault by using a non-integrated Certificate Authority (CA). Which sequence of steps should you perform to complete this process? To answer, drag the appropriate actions from the list of actions to the answer area and arrange them in the correct sequence.

  1. 1Create a certificate in Azure Key Vault with the policy set to use a non-integrated CA (Issuer Name set to Unknown).
  2. 2Download the Certificate Signing Request (CSR) file from the pending certificate in Azure Key Vault.
  3. 3Submit the CSR to your external Certificate Authority (CA) and download the signed certificate.
  4. 4Merge the signed certificate into the pending certificate request in Azure Key Vault.

Answer

The correct sequence of steps is: First, create a certificate in Azure Key Vault with the policy set to use a non-integrated CA (Issuer Name set to Unknown). Second, download the Certificate Signing Request (CSR) file from the pending certificate. Third, submit the CSR to your external Certificate Authority (CA) and download the signed certificate. Finally, merge the signed certificate into the pending certificate request in Azure Key Vault.
To create a certificate in Azure Key Vault using a non-integrated CA, you must first initiate the request in Key Vault by setting the issuer to Unknown. This generates a private key and a CSR within Key Vault. Next, you download the CSR to submit it to the external CA. Once the CA issues the signed certificate, you merge it back into the pending request to pair it with the private key.

Step-by-Step Solution

1
Create the certificate with the issuer set to Unknown.
Azure Key Vault generates a key pair and a CSR, and sets the certificate status to pending.
This is the initial step required to generate the CSR within Key Vault's secure boundary.
2
Retrieve the CSR from the pending certificate.
The CSR file (.csr or PEM format) is downloaded.
The CSR contains the public key and identity information that must be signed by the external CA.
3
Submit the CSR to the CA and retrieve the signed certificate.
A signed public certificate (.cer or .crt file) is obtained from the CA.
The external CA validates ownership and issues the signed certificate.
4
Merge the signed certificate in Azure Key Vault.
The pending certificate status changes to active, associating the private key with the signed certificate.
This finalizes the certificate creation process inside the Key Vault.

Key Concept

Azure Key Vault Certificate Lifecycle Management with Non-Integrated CA
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic