You deploy a GPU-accelerated Python rendering app to an Azure Container Instance (ACI) Linux container. The app requires a secret value at container start, and the secret must be accessible only from inside the container. Which two methods will satisfy this requirement? (Each correct answer is a complete solution.)

Setting an environment variable with secureValue ensures the secret is encrypted at rest and masked in logs, making it accessible only within the container at runtime. This is a standard and secure way to inject secrets. Mounting a secret volume provides a file-based mechanism for secrets. ACI supports mounting an Azure File share as a secret volume, allowing you to store secrets securely in a file that the container can access, again, only from within the container. Baking the secret into the image is insecure as it becomes part of the image layer history. Hard-coding is always insecure. Storing in Blob storage with a SAS token is less ideal for secrets needed at startup and introduces external dependencies and potential exposure if the SAS token is compromised or logged.