AZ-204 Implement Azure security Practice Question
Your company uses Azure Key Vault to store secrets. You need to ensure that if a secret is deleted, it can be recovered within 30 days. Which Key Vault feature should you enable?
⚠ Common exam trap
It's easy for candidates to confuse purge protection with soft-delete, thinking that purge protection alone allows recovery, when in fact purge protection only prevents permanent deletion after soft-delete has already occurred.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Soft-delete
Soft-delete is the correct feature because it allows you to recover a deleted secret within a configurable retention period (default 90 days, but can be set to as low as 1 day). When soft-delete is enabled, a deleted secret is marked as deleted but remains recoverable until the retention period expires. This directly meets the requirement to recover a secret within 30 days.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Soft-delete
Why this is correct
Soft-delete is the essential feature for recovering deleted secrets, keys, and certificates in Azure Key Vault. When enabled, it retains deleted items for a configurable retention period, typically 90 days by default, moving them to a 'soft-deleted' state. During this period, these items can be restored to their original state, preventing accidental or malicious permanent data loss and ensuring business continuity. This mechanism provides a crucial safety net for managing sensitive information within the vault.
- ✗
Purge protection
Why it's wrong here
Purge protection is a critical security feature that, when enabled alongside soft-delete, prevents the immediate and irreversible deletion (purging) of a soft-deleted vault or its objects. While soft-delete allows recovery, purge protection ensures that even an authorized user cannot bypass the retention period to permanently delete items, thereby enforcing the full soft-delete retention policy. It acts as a safeguard against insider threats or compromised credentials, but it does not, by itself, enable the recovery process; it merely prevents premature permanent deletion.
- ✗
RBAC (Role-Based Access Control)
Why it's wrong here
Azure Key Vault's Role-Based Access Control (RBAC) provides granular permissions management at the resource group, subscription, or individual vault level, defining *who* can perform *what* actions on the vault and its objects. For instance, an RBAC role might grant permission to 'get' or 'set' secrets, but it does not offer any mechanism to recover a secret once it has been deleted. RBAC is purely an authorization system, governing access and operations, not a data recovery or retention service.
- ✗
Access policies
Why it's wrong here
Access policies are the legacy authorization model for Azure Key Vault, defining specific permissions directly on the vault itself for users, groups, or applications. These policies dictate actions like 'get,' 'list,' 'set,' or 'delete' for keys, secrets, and certificates, controlling operational access to the vault's contents. However, like RBAC, access policies are solely concerned with controlling permissions for live operations and do not provide any functionality for recovering secrets that have already been deleted from the vault.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.