AZ-204 Implement Azure security Practice Question
Network Topology
Refer to the exhibit. You run the Azure CLI command to store a secret in Key Vault. Later, you run 'az keyvault secret show --vault-name myvault --name MySecret'. What will be displayed?
⚠ Common exam trap
Many candidates confuse the Azure CLI's `show` command with the Azure Portal's secret display, which masks the value by default, leading them to incorrectly assume the CLI also masks the output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The secret's metadata and the value 'P@ssw0rd123'.
The `az keyvault secret show` command retrieves the secret's metadata along with its value in plaintext. When you store a secret using `az keyvault secret set`, the value is stored securely, and the `show` command returns the full secret object, including the `value` field, as demonstrated in the exhibit where the stored value is 'P@ssw0rd123'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The secret's metadata only, without the value.
Why it's wrong here
The `az keyvault secret show` command is designed to display the complete secret object, which inherently includes both its metadata (such as ID, content type, and enabled status) and the actual secret value. Retrieving only the metadata without the value would require a different command or specific filtering, as the `show` operation's primary intent is to provide the secret's content for authorized use. Therefore, stating it returns only metadata is incorrect.
- ✗
The secret's metadata with the value masked as '*****'.
Why it's wrong here
The Azure CLI's `az keyvault secret show` command does not mask the secret value by default when retrieving it. This command is intended for direct programmatic or administrative access where the full plaintext value is required for configuration or application use. Masking typically occurs in user interfaces, logs, or specific output formatting tools, not as a standard behavior for direct secret retrieval commands, making this option incorrect.
- ✓
The secret's metadata and the value 'P@ssw0rd123'.
Why this is correct
The `az keyvault secret show` command correctly retrieves the full secret object, encompassing both its comprehensive metadata and the actual plaintext value, 'P@ssw0rd123'. This functionality is fundamental for applications and administrators needing to access the secret's content for operational purposes. The command's output provides all necessary details, including the secret's attributes and its sensitive value, as intended for authorized retrieval.
- ✗
An error because you cannot retrieve a secret after it is set.
Why it's wrong here
This statement is fundamentally incorrect because Azure Key Vault's primary purpose is to securely store and *enable retrieval* of secrets, keys, and certificates. If secrets could not be retrieved after being set, the service would be impractical for any application or service requiring access to sensitive configuration data. Authorized users or service principals, granted appropriate `Get` permissions via access policies or Azure RBAC, can always retrieve secrets.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.