You manage certificates for workloads in Azure. You need to use Azure Key Vault to store an existing PFX for immediate use and also enable automatic renewal and rotation for future certificates issued by a public CA. What should you configure? Choose two actions.

To use an existing PFX immediately, you must import it into Key Vault as a Certificate, which includes the private key. Consuming services then need Secret GET access to retrieve the certificate data. For future certificates and automatic renewal, you need to configure a Certificate Issuer within Key Vault. This links Key Vault to a public CA. Then, when you create a new certificate in Key Vault, you define a policy that includes lifetime actions, such as auto-renewal a specified number of days before expiry. Enabling automatic rotation on an imported PFX is incorrect because Key Vault cannot directly renew certificates with the original CA without an integrated issuer. Azure Policy cannot auto-rotate certificates without issuer configuration, as it lacks the mechanism to interact with CAs. App Service Managed Certificates are specific to Azure App Service and do not manage certificates for general workloads in Key Vault.