When granting an ASP.NET Core application access to secrets in Azure Key Vault using least privilege, which secret permission should be assigned in the Key Vault access policy?

The correct answer is Get only. An ASP.NET Core application typically needs to retrieve (get) specific secrets from Azure Key Vault to function, such as database connection strings or API keys. Granting "Get only" permission adheres to the principle of least privilege, meaning the application has only the necessary access and nothing more. List only: This permission would allow the application to see the names of all secrets in the Key Vault but not retrieve their values, making it insufficient for the application's needs. Get and List: While this would allow the application to retrieve secrets, the "List" permission is generally unnecessary for an application that knows the specific secret names it needs. Granting "List" unnecessarily expands the application's access, violating the principle of least privilege.