AZ-204 Implement Azure security Practice Question
A developer deleted a secret from Azure Key Vault with soft-delete and purge protection enabled (retention 90 days). After 50 days, the secret is needed again. What is the correct recovery method?
⚠ Common exam trap
Many exam-takers confuse soft-delete recovery with backup/restore or assume that recreating the secret with the same name is possible, not realizing that soft-deleted secrets block name reuse until purged or the retention period ends.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recover the secret using Azure CLI 'az keyvault secret recover'
Azure Key Vault with soft-delete and purge protection enabled retains deleted secrets for the specified retention period (90 days in this case). Since only 50 days have passed, the secret is still in a soft-deleted state and can be recovered using the 'az keyvault secret recover' command, which restores the secret to its original state without data loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Purge the secret and then restore from a backup
Why it's wrong here
When a secret is soft-deleted, it enters a recoverable state within the Azure Key Vault. Purging a soft-deleted secret explicitly removes it permanently from the Key Vault service, bypassing the recovery mechanism. This action makes the secret unrecoverable, even if a backup existed, because the original secret's unique identifier and version are permanently removed from the Key Vault itself. Restoring from a backup would involve creating a *new* secret, not recovering the *original* soft-deleted one.
- ✓
Recover the secret using Azure CLI 'az keyvault secret recover'
Why this is correct
Azure Key Vault's soft-delete feature retains deleted secrets for a specified retention period, typically 90 days by default, making them recoverable. The `az keyvault secret recover` command is specifically designed to transition a soft-deleted secret back into an active state within this retention window. This command restores the secret with all its original properties, versions, and access policies, effectively reversing the deletion operation.
- ✗
Recreate the secret with the same name
Why it's wrong here
When soft-delete is enabled for an Azure Key Vault, a deleted secret's name remains reserved within the vault during its retention period. This prevents the creation of a new secret with an identical name, even if the original is in a soft-deleted state. Attempting to recreate a secret with the same name would result in a naming conflict error, requiring either recovery of the original or waiting for its permanent purge after the retention period.
- ✗
Use an Azure Resource Manager template to undelete the secret
Why it's wrong here
Azure Resource Manager (ARM) templates are declarative JSON files primarily used for defining and deploying Azure resources and their configurations. While ARM templates can provision a Key Vault and its secrets, they are not designed for performing operational actions like recovering soft-deleted items. Recovery operations, such as undeleting a secret, are typically executed via management plane APIs, SDKs, or command-line tools like Azure CLI or PowerShell, which interact directly with the Key Vault service's runtime state.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.