You have an Azure subscription that contains an Azure key vault named Vault1. You plan to deploy a virtual machine named VM1 that will run Windows Server. You need to enable encryption at host for…

This question tests knowledge of the correct sequence to enable Azure VM encryption at host using customer-managed keys (CMK) stored in an existing Azure Key Vault. It requires understanding the dependency chain between feature registration, disk encryption sets, and VM…

Secure Windows Server on-premises and hybrid infrastructures

Question

You have an Azure subscription that contains an Azure key vault named Vault1.
You plan to deploy a virtual machine named VM1 that will run Windows Server.
You need to enable encryption at host for VM1. The solution must use customer-managed keys.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Explanation

Approach. The correct three-step sequence is: (1) Register the EncryptionAtHost feature for the subscription via 'Register-AzProviderFeature -FeatureName EncryptionAtHost -ProviderNamespace Microsoft.Compute' - this feature is not enabled by default and must be explicitly registered before any VM can use it. (2) Create a Disk Encryption Set (DES) that references a customer-managed key stored in Vault1 - the DES is the Azure resource that bridges your CMK in Key Vault to managed disk encryption, and you must also grant the DES's system-assigned managed identity 'Get', 'WrapKey', and 'UnwrapKey' permissions on Vault1. (3) Deploy VM1 with encryption at host enabled and the Disk Encryption Set associated - you set the 'EncryptionAtHost' property on the VM's security profile and reference the DES so all host-level caches (OS disk, data disk, temp disk) are encrypted with your CMK. Skipping or reordering any step breaks the dependency chain: the feature must exist before the VM type is valid, and the DES must exist before the VM can reference it.

Concept tested. Azure Encryption at Host with Customer-Managed Keys (CMK) - specifically the prerequisite feature registration (EncryptionAtHost provider feature), the role of Disk Encryption Sets as the CMK-to-disk bridge, Key Vault access policy/RBAC grants to the DES managed identity, and the correct provisioning order before VM deployment.

Reference. https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal

Topics

#Azure Disk Encryption#Customer-Managed Keys#Azure Key Vault#Encryption at Host

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice