Which built-in role permits reading secret values but not managing the vault?

1. A Key Vault Contributor
2. ✓ B Key Vault Secrets User (correct answer)
3. C Key Vault Administrator
4. D Key Vault Reader

Shortcut: Key Vault Secrets User grants data-plane read of secret values. Key Vault Reader sees metadata only; Contributor manages the resource but not necessarily data.