AZ-104 Question 136
Single answerYou manage a Windows Server 2019 VM in Azure and want to enable Azure Disk Encryption using a custom key stored in an Azure Key Vault in the same region. However, the encryption process fails. Which step must you complete first to successfully enable disk encryption for your VM?
- A
Create a new dedicated storage account for the encrypted VM disks
- B
Assign the Disk Encryption Set resource token to your VM
- C
Grant required Key Vault access policies to the Azure Disk Encryption extension
- D
Enable double encryption by configuring Server-Side Encryption with customer-managed keys
Show answer and explanation
Correct answer: C
Explanation
To successfully enable Azure Disk Encryption, the VM must have access to the encryption key stored in Azure Key Vault. Configuring the access policy on Key Vault ensures that the Azure Disk Encryption extension can retrieve the key needed to encrypt the disks.
- A. Incorrect.
Creating a new storage account alone does not resolve permission-related errors or configure the extension for disk encryption.
- B. Incorrect.
Disk Encryption Set tokens are not strictly required to encrypt an existing VM with Azure Disk Encryption; that approach typically applies to Azure RBAC-based encryption scenarios.
- C. Correct.
You must configure the Key Vault access policies properly so that the Azure Disk Encryption extension can retrieve and use the required key. Without these policies, the extension cannot access the Key Vault, causing encryption to fail.
- D. Incorrect.
Double encryption is an additional layer of protection but not required as a first step. You need to enable the disk encryption extension with the correct access policies before considering further encryption layers.