You need to configure VM encryption. Select and arrange the correct actions from the following list to complete the task: Actions: Create VM1 and associate the disks of the virtual machine with the…

Question

Explanation

This simulation tests knowledge of configuring Azure VM disk encryption using Customer-Managed Keys (CMK) via a Disk Encryption Set (DES) linked to an Azure Key Vault. The correct sequence ensures the Key Vault, Disk Encryption Set, and VM are wired together in the right order.

Approach. The correct sequence is: (1) Create a disk encryption set and generate RSA keys - the DES must exist and reference a Key Vault key before anything else can use it. (2) Grant Vault1 the managed identity permission for the disk encryption set - the DES has its own system-assigned managed identity that must be granted 'get', 'wrapKey', and 'unwrapKey' permissions on the Key Vault; without this the DES cannot retrieve the key to encrypt/decrypt disks. (3) Create VM1 and associate the disks with the disk encryption set - only after the DES has valid Key Vault access can VM disks be linked to it. Steps involving enabling a managed identity on VM1 and assigning the Virtual Machine Contributor role are either distractors or apply to a separate access-delegation scenario unrelated to disk encryption itself; the VM's own identity does not need those permissions for CMK disk encryption.

Concept tested. Azure Disk Encryption with Customer-Managed Keys (CMK) using Disk Encryption Sets (DES) and Azure Key Vault - specifically the dependency chain: Key Vault key → Disk Encryption Set → DES managed identity Key Vault access grant → VM disk association.

Reference. https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview

No community discussion yet for this question.