You are developing an Al-powered API that retrieves connection strings and API keys from Azure Key Vault.

You must configure a solution that provides the following security functionality:

* The API must authenticate to Key Vault without storing credentials in any application configuration files

* The identity used by tie API must have only the minimum permissions necessary to lead secrets.

* The configuration must minimize the blast radius if an identity or credent al is compromised.

You need to implement a secure access strategy for the API.

Which two actions should you perform? Each correct answer presents part of the solution. Choose two.

NOTE: Each correct selection is worth one point.