Which trigger(s) should prompt key rotation in a TA environment?

• A. On a fixed schedule alone
• B. After suspected breach, or when policies change
• C. Only when a certificate expires
• D. When a new device is added

Answer: (B)

Key rotation in a TA environment is about limiting risk whenever trust assumptions change or a threat is detected. The most effective triggers are when there’s a suspected breach or when policies change. If you rotate only on a fixed schedule, you might miss a breach that happens between rotations, and you may rotate more often than needed, causing unnecessary disruption. Waiting until a certificate expires means a compromised key could remain valid for a long period. Adding a new device is important for provisioning, but it doesn’t by itself justify rotating all keys; rotation should be driven by changes in risk or governance, not just routine onboarding. By rotating after a suspected breach or when policies change, you revoke compromised credentials quickly and enforce new access controls and cryptographic practices.