AZ-204 Implement Azure security Practice Question
Your company stores secrets in Azure Key Vault. You need to ensure that when a secret is disabled, it does not become accessible to applications that already have a cached copy. Which additional step must you take?
⚠ Common exam trap
Candidates often assume disabling a secret immediately revokes all access, but they overlook the fact that applications may hold a cached copy that remains valid until the cache expires or the secret is rotated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rotate the secret immediately
When a secret is disabled in Azure Key Vault, the vault itself will reject new access requests, but applications that have already retrieved and cached the secret can continue using it until the cache expires or is refreshed. To immediately invalidate the cached copy, you must rotate the secret (change its value) so that any subsequent attempt to use the old cached value fails because it no longer matches the secret stored in Key Vault. Disabling alone does not force applications to re-authenticate or re-fetch; rotation ensures the cached value becomes obsolete.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rotate the secret immediately
Why this is correct
Rotating a secret in Azure Key Vault creates a new version with an updated value, effectively marking the previous version as deprecated for general use. This action is crucial because applications are typically configured to retrieve the *latest* version of a secret. Upon their next scheduled refresh or explicit retrieval attempt, they will fetch the new value, thereby invalidating any previously cached copies of the older secret value and ensuring they operate with the most current credential. This directly addresses the need to force applications to use a new secret.
- ✗
Delete the secret
Why it's wrong here
Deleting a secret from Azure Key Vault prevents any *future* successful retrieval attempts by applications, causing subsequent requests for that secret to fail. However, this action does not retroactively invalidate or clear any copies of the secret that applications have already successfully retrieved and stored in their local memory or persistent caches. Applications will continue to operate using their cached, now invalid, secret until their cache expires, they attempt a refresh, or they restart, at which point they would encounter an error.
- ✗
Enable soft-delete and purge protection
Why it's wrong here
Enabling soft-delete and purge protection for an Azure Key Vault provides critical data protection by preventing the immediate and permanent deletion of secrets. Soft-delete retains deleted items for a configurable period, while purge protection prevents even privileged users from permanently purging items during that retention. These features are solely focused on disaster recovery and preventing data loss, not on invalidating or forcing a refresh of secret values already cached by client applications. They have no direct impact on an application's operational use of a secret.
- ✗
Use Key Vault access policies to deny access
Why it's wrong here
Modifying Key Vault access policies (or Azure RBAC assignments) to deny an application's identity permission to `get` a secret will prevent *future* successful retrieval attempts. Any subsequent requests by that application to fetch the secret will be unauthorized and fail. However, this action does not affect the secret's value if it has already been successfully retrieved and cached by the application prior to the policy change. The application will continue to use its existing cached, now unauthorized, secret until its cache expires or it attempts a refresh.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.