Configure processes and communications →hardMultiple ChoiceObjective-mapped

AZ-400 Configure processes and communications Practice Question

Exhibit

Refer to the exhibit.
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "environmentName": {
      "value": "production"
    },
    "sqlAdminLogin": {
      "reference": {
        "keyVault": {
          "id": "/subscriptions/123/resourceGroups/rg-kv/providers/Microsoft.KeyVault/vaults/kv-prod"
        },
        "secretName": "sql-admin-login"
      }
    }
  }
}

You are deploying an ARM template using the parameters file shown. The deployment fails with an error that the referenced secret cannot be found. What is the most likely cause?

⚠ Common exam trap

Candidates often confuse the 'secret not found' error with permission issues (Option B), but the error message specifically indicates the secret name mismatch, not an access policy problem.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The secret name in the parameters file does not match the actual secret name in Key Vault.

The error 'referenced secret cannot be found' directly indicates that the secret name specified in the parameters file does not match the actual secret name stored in Azure Key Vault. ARM template deployment uses the `reference()` function to retrieve the secret value at deployment time, and if the secret name is misspelled or incorrect, the deployment fails with this specific error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The secret name in the parameters file does not match the actual secret name in Key Vault.
Why this is correct
An ARM template dynamic Key Vault reference resolves the secret by name exactly as specified in the parameters file. If the name contains a typo or does not match the secret's actual name in Key Vault (including case sensitivity for secret names), Azure returns a 'Secret not found' error, even if the Key Vault and access policies are correctly configured.
✗
The Key Vault does not have an access policy granting the deployment user 'Get' secret permission.
Why it's wrong here
An access policy denial results in an 'access denied' or 'forbidden' error (HTTP 403), not 'not found'. The deployment user must have 'Get' permission on the secret for the reference to succeed; if permission is missing, the error explicitly indicates authorization failure rather than the secret being absent.
✗
The resource group 'rg-kv' does not exist.
Why it's wrong here
The error message is specifically about the secret not being found, not about the resource group. If 'rg-kv' did not exist, Azure would raise a resource group not found error before attempting to resolve the secret. Since the parameters file references the Key Vault by resource group and secret name, a non-existent resource group would produce a different, earlier failure.
✗
The Key Vault is in a different region than the deployment.
Why it's wrong here
Key Vault secret references in ARM templates are not region-restricted; cross-region access is fully supported. A Key Vault in a different region than the deployment does not cause a 'secret not found' error. The reference simply uses the Key Vault's resource ID, which is globally resolvable, so the secret can be retrieved regardless of region.

Go deeper

AZ-400 Configure processes and communications Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question