Applications need centrally governed storage of secrets, encryption keys, and certificates. The architect wants role-based access and auditable access operations. Which service fits?

1. A resource tag collection
2. Azure Key Vault
3. A DNS TXT record set
4. A public Blob container