AZ-204 Implement Azure security Practice Question
Network Topology
Refer to the exhibit. You run the Azure CLI command to retrieve a secret from Azure Key Vault. The output shows the secret metadata but not the secret value. The command returns without error. What is the most likely cause?
⚠ Common exam trap
Many candidates assume the command output includes the secret value by default, but Azure CLI intentionally omits it for security, requiring an explicit `--query "value"` to retrieve the actual secret.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The command output only shows metadata by default; you must specify --query "value" to retrieve the secret value.
The Azure CLI `az keyvault secret show` command returns the secret metadata (including attributes like id, enabled, created, updated) by default, but does not include the secret value unless you explicitly request it using the `--query "value"` parameter. Since the command completed without error and only metadata was shown, the most likely cause is that the output was not filtered to retrieve the secret value.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The secret has expired.
Why it's wrong here
The exhibit's output for the secret's properties would include an "attributes" section. Within this section, the "exp" (expiration time) field, if present and not null, indicates when the secret will automatically become inactive. If the "exp" field is null or entirely absent from the metadata, it signifies that no expiration date has been set for the secret, meaning it is not currently expired and will remain active indefinitely unless manually disabled or deleted.
- ✗
The user does not have the Key Vault Secrets Officer role.
Why it's wrong here
The command successfully returned a JSON object containing various metadata fields for the secret, such as its ID, attributes, and tags. This successful retrieval of metadata confirms that the executing user or service principal possesses sufficient read permissions on the Key Vault and the specific secret. If the user lacked the necessary permissions, such as the "Microsoft.KeyVault/vaults/secrets/get" data action, the command would have resulted in an authorization error, not a partial metadata output.
- ✗
The secret is in a soft-deleted state.
Why it's wrong here
If the secret were in a soft-deleted state, attempting to retrieve it with "az keyvault secret show" would typically result in a 'Secret not found' or 'Forbidden' error, as soft-deleted items are moved to a separate retention area and are not accessible via standard 'get' operations. To interact with a soft-deleted secret, specific commands like "az keyvault secret show-deleted" or "az keyvault secret recover" would be required, which is not what the exhibit implies was attempted or achieved.
- ✓
The command output only shows metadata by default; you must specify --query "value" to retrieve the secret value.
Why this is correct
Azure CLI commands for Key Vault secrets are inherently security-conscious, and by default, "az keyvault secret show" only displays the secret's metadata, such as its ID, attributes, and tags, but intentionally omits the sensitive "value" field. This design choice prevents accidental exposure of secret content in terminal outputs or logs. To explicitly retrieve the actual secret value, users must leverage the "--query \"value\"" parameter, which uses JMESPath to filter the JSON response and extract only the desired sensitive data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.