nerdexam
Microsoft

AZ-204 · Question #209

Drag and Drop Question You are developing an application to securely transfer data between on-premises file systems and Azure Blob storage. The application stores keys, secrets, and certificates in Az

The correct answer is Soft delete; Purge protection. Soft delete must be enabled first to allow recovery of accidentally deleted key vaults or key vault objects - it retains deleted items for a configurable retention period (90 days in this case) and allows them to be recovered. Purge protection builds on top of soft delete by prev

Submitted by mateo_ar· Mar 30, 2026Implement Azure security - Secure Azure solutions with Azure Key Vault (AZ-204 / AZ-500: Configure key vault recovery options including soft delete and purge protection)

Question

Drag and Drop Question You are developing an application to securely transfer data between on-premises file systems and Azure Blob storage. The application stores keys, secrets, and certificates in Azure Key Vault. The application uses the Azure Key Vault APIs. The application must allow recovery of an accidental deletion of the key vault or key vault objects. Key vault objects must be retained for 90 days after deletion. You need to protect the key vault and key vault objects. Which Azure Key Vault feature should you use? To answer, drag the appropriate features to the correct actions. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-204 question #209 exhibit

Answer Area

Drag items

Access policyPurge protectionSoft deleteShared access signature

Correct arrangement

  • Soft delete
  • Purge protection

Explanation

Soft delete must be enabled first to allow recovery of accidentally deleted key vaults or key vault objects - it retains deleted items for a configurable retention period (90 days in this case) and allows them to be recovered. Purge protection builds on top of soft delete by preventing permanent deletion (purging) of the key vault or its objects during the retention period, ensuring that even administrators cannot bypass the 90-day retention window. Together, these two features fulfill both requirements: recoverability and enforced retention.

Topics

#Azure Key Vault#Soft Delete#Purge Protection#Data Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-204 Practice