A secret must be rotated automatically every 60 days. Which combination implements this?

1. ✓ A A rotation policy plus an Event Grid notification triggering a Function that generates and stores the new value (correct answer)
2. B A TTL on the secret
3. C Manual rotation only
4. D Soft delete

Shortcut: Key Vault rotation policies emit near-expiry events. A subscriber, typically a Function, performs the credential change at the source system and writes the new version back.