You plan to deploy an Azure confidential virtual machine named VM1. You need to ensure that you can implement confidential disk encryption for VM1. What should you do? To answer, select the appropriat

Question

Explanation

This question tests knowledge of the prerequisites required to enable confidential disk encryption on an Azure Confidential Virtual Machine (VM). Confidential disk encryption is a distinct, stronger form of encryption that binds disk keys to the VM's virtual Trusted Platform Module (vTPM), requiring specific configuration steps before deployment.

Approach. To implement confidential disk encryption for a Confidential VM, you must: (1) Select a VM size that supports confidential computing, such as the DCasv5-series or ECasv5-series (AMD SEV-SNP based), as standard VM sizes do not support this feature. (2) Create a Disk Encryption Set (DES) and configure its encryption type to 'Confidential disk encryption' (either platform-managed or customer-managed key variant). (3) If using customer-managed keys, the key must be stored in an Azure Key Vault configured with HSM-backed keys (Premium SKU) or an Azure Managed HSM, because confidential disk encryption requires hardware-level key protection. (4) Associate the Disk Encryption Set with the OS disk during VM creation - this cannot be applied retroactively to an existing disk without redeployment.

Concept tested. Azure Confidential Computing - specifically the prerequisites and configuration steps for enabling Confidential Disk Encryption on Confidential VMs, including compatible VM SKU selection, Disk Encryption Set configuration with the confidential encryption type, and HSM-backed key storage in Azure Key Vault Premium or Azure Managed HSM.

Reference. https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview#confidential-disk-encryption

No community discussion yet for this question.