AZ-104 Question 137
Select 3Your organization needs to encrypt both the OS disk and data disk of a Windows VM using Azure Disk Encryption. The VM resides in a private virtual network and uses a private endpoint-enabled Azure Key Vault. You have already created a user-assigned managed identity with the required Key Vault permissions. Which steps must you complete to successfully configure Azure Disk Encryption on the VM? (Select all that apply)
- A
Ensure the Key Vault is in the same region as the VM
- B
Grant the user-assigned managed identity permission to retrieve encryption keys from Key Vault
- C
Enable the Azure Disk Encryption extension on the VM
- D
Expose the Key Vault over a public IP address
- E
Enable ephemeral OS disks for the VM to store secrets locally
Show answer and explanation
Correct answers: A, B, C
Explanation
Azure Disk Encryption relies on the Azure Disk Encryption extension and a Key Vault in the same region. The user-assigned managed identity must have the appropriate Key Vault permissions to manage encryption keys. Ensuring the Key Vault is placed privately rather than publicly, and enabling the encryption extension on the VM, are core steps in the Azure Disk Encryption setup process.
- A. Correct.
Key Vault must reside in the same region as the VM for Azure Disk Encryption to function properly.
- B. Correct.
The VM or its associated managed identity needs permissions (such as get, wrapKey, and unwrapKey) to retrieve and manage keys in Key Vault.
- C. Correct.
Enabling the encryption extension is required to configure and apply Azure Disk Encryption on the VM’s OS and data disks.
- D. Incorrect.
Public IP exposure is not required and contradicts the use of private endpoints for securing the Key Vault.
- E. Incorrect.
Ephemeral OS disks are not used for disk encryption; they provide local temporary storage and do not fulfill the encryption requirements.