A financial services company must deploy an Azure Virtual Desktop pooled host pool that processes highly sensitive data. Compliance requires that the memory of each session host be encrypted and isolated from the underlying hypervisor, with hardware-based attestation of the VM's integrity at boot. The team wants to use a purpose-built VM offering rather than manually layering security features onto a standard VM. Which session host VM configuration meets these requirements?