Question

You manage a set of production virtual machines in Azure. Compliance requires that all temporary disks, OS disk caches, and data disk caches be encrypted from the point of storage on the Azure host, without using Azure Disk Encryption inside the guest OS. You attempt to create a new VM with encryption at host enabled, but the option is unavailable for the subscription. What must you do first before you can enable encryption at host?

Accepted Answer

Register the EncryptionAtHost feature for the subscription using the Microsoft.Compute resource provider.

Answer

Install the Azure Disk Encryption extension on each VM before creating them.

Answer

Assign a customer-managed key in Azure Key Vault to the storage account hosting the VM disks.

Answer

Deploy the VMs into a proximity placement group to allow host-level encryption.