AZ-104 Question 138
Single answerYou are an Azure Administrator for a large research firm. One of your production Windows VMs needs to have its OS disk encrypted as part of the company’s compliance requirements. You have already created an Azure Key Vault and granted the VM’s system-assigned managed identity the required permissions. Which step should you take to ensure the OS disk is properly encrypted using Azure Disk Encryption?
- A
Enable server-side encryption with customer-managed keys on the OS disk directly in the portal
- B
Add the Azure Disk Encryption extension to the VM and specify your Azure Key Vault
- C
Recreate the VM with a pre-configured encrypted image in the Azure Marketplace
- D
Use disk snapshotting to clone the OS disk, encrypt the snapshot, and replace the original disk
Show answer and explanation
Correct answer: B
Explanation
Azure Disk Encryption uses the Azure Disk Encryption extension to enable compliance-grade encryption for both the OS and data disks. By integrating with Azure Key Vault, you can store and manage the encryption keys securely. Of the options listed, installing and enabling the Azure Disk Encryption extension with your existing Key Vault is the correct and supported procedure for encrypting an existing VM’s OS disk.
- A. Incorrect.
Server-side encryption with customer-managed keys is a different approach than Azure Disk Encryption and does not directly configure OS-level encryption with the Azure Disk Encryption extension.
- B. Correct.
This is the correct process for configuring Azure Disk Encryption on an existing VM, as you install and enable the Azure Disk Encryption extension and use the Key Vault to store and manage the encryption keys.
- C. Incorrect.
Rebuilding the VM with an already encrypted image may work for new deployments but is not the recommended path for an existing production VM that needs to remain active.
- D. Incorrect.
While snapshotting provides a way to back up or migrate data, it is not the supported method for encrypting an existing OS disk with Azure Disk Encryption.