AZ-500 Question 139
Single answerYour company has mandated that all new Windows VMs must be encrypted at rest using keys you own and manage in Azure Key Vault. Additionally, the solution must minimize performance overhead and support ephemeral OS disks for quick deployments. Which disk encryption approach provides the best fit for these requirements?
- A
Azure Disk Encryption (ADE) with BitLocker and a passphrase stored in Azure Key Vault
- B
Azure SSE (Server-Side Encryption) with platform-managed keys
- C
Azure SSE (Server-Side Encryption) with customer-managed keys (CMK) from Azure Key Vault
- D
Confidential disk encryption using ephemeral OS disks
Show answer and explanation
Correct answer: C
Explanation
Ephemeral OS disks are not supported by Azure Disk Encryption (ADE). Instead, Azure SSE with customer-managed keys (stored in Azure Key Vault) is the recommended approach for organizations requiring their own key management while still supporting ephemeral OS disks and minimizing performance overhead. For more details, refer to the official Microsoft documentation on Azure Disk Encryption limitations (https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview) and server-side encryption with CMK (https://learn.microsoft.com/azure/storage/common/storage-encryption-keys-portal).
- A. Incorrect.
Incorrect. Azure Disk Encryption (ADE) relies on technologies like BitLocker (for Windows) or DM-Crypt (for Linux), and it does not support ephemeral OS disks. Additionally, ADE typically introduces more overhead than SSE with CMK.
- B. Incorrect.
Incorrect. Using platform-managed keys meets the requirement for data-at-rest encryption but does not address the organization's requirement to use their own customer-managed keys stored in Azure Key Vault.
- C. Correct.
Correct. Azure SSE with customer-managed keys (CMK) allows you to store and manage your own encryption keys in Azure Key Vault, meets regulatory needs, and supports ephemeral OS disks. It also has less performance overhead than Azure Disk Encryption.
- D. Incorrect.
Incorrect. While confidential disk encryption can provide strong isolation and encryption, combining ephemeral OS disks with confidential disk encryption is not the standard approach for minimal overhead and key management with your own keys. Additionally, confidential disk encryption focuses on memory isolation and confidential VMs rather than the primary need for ephemeral OS disk support with customer-managed keys.