Rotation previously caused an outage because applications kept using the revoked password. Which TWO practices prevent that?

1. ✓ A Use two credential sets so the old one stays valid while the new one is published (correct answer)
2. ✓ B Refresh the client's cached secret on the Key Vault rotation event rather than only on restart (correct answer)
3. C Fetch the secret from Key Vault on every request
4. D Extend the rotation interval to 12 months
5. E Hardcode the new password at deploy time

Shortcut: Two-set rotation gives an overlap window in which both credentials authenticate, so there is no instant of failure. Caches must then be invalidated by the rotation event. Fetching per request would work but triggers Key Vault throttling; lengthening the interval avoids rather than solves the problem.