You manage an Azure API Management (APIM) instance and need to centralize two values for policies: (1) a non-secret base URL used by multiple APIs, and (2) a database password that rotates monthly. Security mandates that APIM must not store the password and that rotation should not require any policy changes. What should you do? (Choose two)

For the non-secret base URL, a plain named value is appropriate because it's not sensitive and needs to be easily accessible for reuse across policies. For the rotating database password, a Key Vault–backed named value is the correct choice. This approach leverages Azure Key Vault for secure storage and automatic rotation without modifying APIM policies. Using the APIM system-assigned managed identity grants APIM access to Key Vault without needing explicit credentials. A versionless secret identifier ensures that APIM always retrieves the latest version of the secret after rotation, fulfilling the requirement that rotation should not require policy changes. Storing the password directly in APIM as a secret named value is insecure. Product properties are not designed for sensitive, rotating secrets. Base64 encoding only obfuscates, it does not encrypt, and still stores the secret within APIM.