AZ-104 Question 135
Select 2You are deploying a new Ubuntu virtual machine in the East US region with an Availability Zone and want to encrypt the OS disk using a customer-managed key stored in Azure Key Vault. Which steps must you complete during creation to meet these requirements? (Choose two.)
- A
On the Basics tab, select East US as the region. Under Availability options, choose Availability zone and pick Zone 1, 2, or 3.
- B
On the Disks tab, choose Encryption at rest with a custom key and select your Key Vault and existing key.
- C
On the Networking tab, assign a public IP address with DDoS Protection set to Basic.
- D
On the Management tab, enable Boot Diagnostics and select your preferred storage account.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of deploying an Ubuntu VM in an Availability Zone and encrypting the OS disk with a user-provided key, you must select an Availability Zone during creation and configure customer-managed disk encryption using the specified Key Vault key.
- A. Correct.
Selecting the East US region and specifying an Availability Zone ensures redundancy and high availability.
- B. Correct.
Choosing Encryption at rest with a custom key on the Disks tab allows you to configure customer-managed keys from Azure Key Vault.
- C. Incorrect.
Assigning a public IP with DDoS Protection is optional and does not fulfill the requirement of encrypting the OS disk or using an Availability Zone.
- D. Incorrect.
Enabling Boot Diagnostics is useful for troubleshooting but does not address the requirements of zonal deployment and disk encryption.