AZ-801 · Question #196
You have an Azure subscription that contains the Azure key vaults shown in the following table. Vault Name Location Resource group Vault1 East US RG1 Vault2 Central US RG1 Vault3 East US RG2 Vault4…
The correct answer is A. Vault1 only. To enable Azure Disk Encryption for VM1, the encryption key must be stored in a Key Vault located in the same Azure region as the virtual machine.
Question
- Name: VM1
- Resource group: RG1
- Azure region: East US
- Operating system: Windows Server
Exhibit
Options
- AVault1 only
- BVault1 or Vault2 only
- CVault1 or Vault3 only
- DVault1, Vault2, Vault3, or Vault4
How the community answered
(44 responses)- A73% (32)
- B7% (3)
- C16% (7)
- D5% (2)
Why each option
To enable Azure Disk Encryption for VM1, the encryption key must be stored in a Key Vault located in the same Azure region as the virtual machine.
Azure Disk Encryption requires the Key Vault used to store the encryption keys to be in the same Azure region as the virtual machine being encrypted. VM1 is located in the East US region, and Vault1 is the only key vault listed that is also in the East US, making it the only eligible option.
Vault2 is in Central US, which is a different region than VM1 (East US), making it ineligible for storing VM1's encryption keys.
Vault3, while in East US, is often not the only consideration; however, the primary constraint for ADE is the region matching. Vault1 matches both RG and region.
Vault2 (Central US) and Vault4 (Central US) are in different regions than VM1 (East US) and are therefore ineligible for storing VM1's encryption keys.
Concept tested: Azure Disk Encryption Key Vault region requirement
Source: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview#key-vault-requirements
Topics
Community Discussion
No community discussion yet for this question.