A contractor stores a PFX as a generic Key Vault secret string and pastes a 4096-bit RSA value into another secret. How should the security engineer choose Key Vault object types instead?
Select an answer to reveal the explanation.
Short Explanation
Secrets are for passwords and connection strings, keys are for crypto ops, and certificates are for TLS with policy and issuer. Don’t jam a PFX and a raw RSA blob into generic secret strings just because the box accepted the paste.
Full Explanation
Key Vault distinguishes secrets, keys, and certificates. Secrets hold opaque sensitive strings such as passwords and connection strings. Keys support cryptographic operations with managed key material. Certificates combine key pair material with policy and optional issuer integration for TLS lifecycle. Mis-typing objects loses rotation, policy, and operation semantics. App Service TLS upload and NSG constructs are not substitutes for correct Key Vault object selection on AZ-500.