A gorse-fire watch must encrypt a payload with a vault-managed key and must never download the raw key material. Which client pattern is correct?
Select an answer to reveal the explanation.
Short Explanation
Keys are not secrets you yank out and wave around. Use KeyClient encrypt/wrap/sign so the vault does the crypto and a non-exportable key never leaves home.
Full Explanation
Key Vault keys are distinct from secrets. When a key is non-exportable, applications use KeyClient operations such as encrypt, wrap, or sign so material never leaves the vault. Retrieving key material via SecretClient or copying the key into App Configuration or Blob metadata breaks that model.