You have a Standard Key Vault containing a 2048-bit RSA key. To ensure that this key is rotated every 90 days, what should you do first?

Creating a key rotation policy is the correct first step because Azure Key Vault's automated key rotation feature relies on these policies to define rotation frequency and other parameters. Without a policy, automated rotation cannot be configured or initiated. Modifying access policies is incorrect because access policies control who can perform operations on the key vault, not how keys are rotated. Upgrading to Key Vault Premium is unnecessary; automated key rotation is available for both Standard and Premium tiers. Recreating the key as an EC key is irrelevant to the rotation requirement; the existing RSA key can be rotated automatically with a policy.