You are deploying a server application on Windows Server 2019 Server Core. You created an Azure Key Vault and stored a secret. To secure API secrets for third-party integrations using the Key Vault, which three actions should you perform?

To secure API secrets from Azure Key Vault, three key actions are required. First, you must deploy a virtual machine with a system-assigned managed identity. This identity provides an automatically managed credential for Azure services to authenticate to Key Vault without needing to store secrets in your application code. Second, you need to configure Role-Based Access Control (RBAC) for the Key Vault. RBAC allows you to grant specific permissions (e.g., 'Get Secret') to the managed identity of your VM, ensuring it can only perform necessary actions. While Key Vault access policies can also grant permissions, RBAC is the recommended and more granular approach for new deployments. Finally, the application itself must be modified to use the managed identity to access the Key Vault and retrieve the secrets at runtime, rather than hardcoding them. Deploying an Azure DSC extension is for configuration management, not direct Key Vault access.