Which RBAC role should be assigned to an application that only needs to read secrets from Key Vault?

1. A Key Vault Administrator
2. B Key Vault Contributor
3. C Key Vault Secrets Officer
4. ✓ D Key Vault Secrets User (correct answer)

Shortcut: Key Vault Secrets User grants Get and List operations on secrets only — least-privilege for read-only access. Key Vault Secrets Officer adds set/delete. Administrator has full control.