Authenticate using Azure.Identity.DefaultAzureCredential and then use SecretClient to fetch the secret. This is the correct approach for a .NET service to obtain a secret from Azure Key Vault when using the Azure SDK.

DefaultAzureCredential is the recommended authentication chain in the Azure Identity library because it automatically tries a set of credential sources and picks the appropriate one for the environment. It will use a managed identity when running in Azure and developer credentials when you run locally. Using DefaultAzureCredential means you do not need to hard code keys or manually obtain tokens for the most common scenarios.

SecretClient is the modern client type in the Azure.Security.KeyVault.Secrets package that provides simple methods such as GetSecretAsync to read secrets. Using SecretClient together with DefaultAzureCredential is the supported and secure way to fetch a connection string with the Azure SDK for .NET.

Register Microsoft.Extensions.Configuration.AzureKeyVault in the application configuration so secrets are available during startup is not the required step for the Azure SDK approach. That older configuration provider was used in legacy patterns and newer applications generally use the Azure SDK clients or the Azure.Extensions.AspNetCore.Configuration.Secrets provider instead.

Instantiate the legacy KeyVaultClient and attempt to call it without supplying credentials is incorrect because the legacy KeyVaultClient belongs to older libraries and you must supply credentials. The modern SDKs use Azure.Identity and SecretClient and the legacy client is not the recommended path on current exams or in new code.

Acquire a managed identity token and invoke the Key Vault REST API directly instead of using the Azure SDK is technically possible but it is not the expected step when the question asks about using the Azure SDK for .NET. Calling the REST API directly requires manual token management and more boilerplate when the SDK provides a simpler and supported alternative.

Full AWS Practitioner Certification Question