Help desk needs Get on only the Key Vault secret named lock-operator-pin. Which approach provides that object-level scope?
Select an answer to reveal the explanation.
Short Explanation
Access policies are whole-vault guest lists. If help desk should touch only lock-operator-pin, use Azure RBAC scoped to that one secret object and leave the rest alone.
Full Explanation
Vault access policies authorize principals at vault scope for selected secret, key, or certificate permissions; they cannot target a single secret object. Azure RBAC for Key Vault supports assignment at an individual secret, key, or certificate. That granularity is why RBAC is preferred when least privilege requires one object. Broad Contributor or public storage workarounds violate least privilege.