AZ-204 Implement Azure security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Run the Azure CLI command: az keyvault secret recover

  Why this is correct

  Azure Key Vault's soft-delete feature automatically retains deleted secrets for a configurable period, typically 90 days. During this retention window, the secret transitions to a soft-deleted state, not permanently removed from the Key Vault. The `az keyvault secret recover` command is specifically designed to restore a soft-deleted secret to an active state, making it accessible again, provided the retention period has not yet expired. This command directly addresses the scenario of an accidentally deleted secret.

• ✗

  Enable purge protection on the Key Vault first, then recover the secret.

  Why it's wrong here

  Purge protection is an optional, advanced security feature for Azure Key Vault that, when enabled, prevents the permanent deletion (purging) of soft-deleted secrets, even by users with purge permissions. While it significantly enhances data protection by ensuring secrets cannot be immediately and irrevocably removed, it is not a prerequisite for recovering a soft-deleted secret. Recovery is possible as long as soft-delete is enabled and the secret is within its retention period, regardless of purge protection's status.

• ✗

  Recover is not possible because the retention period of 90 days has not elapsed.

  Why it's wrong here

  This statement is incorrect because recovery *is* possible precisely *because* the retention period of 90 days has not elapsed. Azure Key Vault's soft-delete feature is designed to retain deleted secrets for a default of 90 days, making them recoverable during this window. As long as the secret was deleted less than 90 days ago, it remains in a recoverable state, allowing it to be restored using the `az keyvault secret recover` command. The retention period defines the window *during which* recovery is possible, not a barrier to it.

• ✗

  Run the Azure CLI command: az keyvault secret undelete

  Why it's wrong here

  The command `az keyvault secret undelete` is not a valid Azure CLI command for restoring soft-deleted Key Vault secrets. While "undelete" might intuitively sound like the correct action for recovery, the officially supported and correct Azure CLI command for this specific operation is `az keyvault secret recover`. Attempting to use `az keyvault secret undelete` would result in a command-not-found error, preventing any successful secret recovery.