AZ-104 Practice Question 25: Encryption at Host
Microsoft Azure Administrator Associate (AZ-104) · Test 3 · question 5 of 10
An audit finding says that the temporary disk and the OS and data disk caches on a fleet of Azure VMs are not encrypted at rest. The platform team adds two conditions: no encryption agent may run inside the guest operating system, and the fix must not consume VM CPU or slow the workload.
None of the VMs currently has Azure Disk Encryption enabled. What should you do?
Show answer and explanation
Answer:
Encryption at host is the feature that closes exactly this gap: "the data for your temporary disk and OS/data disk caches are stored on that VM host. After enabling encryption at host, all this data is encrypted at rest and flows encrypted to the Storage service, where it's persisted." It runs on the host, not in the guest, so no agent is installed, and Microsoft states it "doesn't use your VM's CPU and doesn't impact your VM's performance." The operational detail that makes this a *deallocate* job: "existing VMs must be deallocated and reallocated in order to be encrypted."
Option A violates the guest-agent constraint by design; Azure Disk Encryption "leverages either the DM-Crypt feature of Linux or the BitLocker feature of Windows ... within the guest VM", and it is mutually exclusive with the correct answer, since encryption at host "can't be enabled on virtual machines ... that currently or ever had Azure Disk Encryption enabled."
Option B restates the very gap the audit found. Server-side encryption protects managed disks, but "temporary disks are not managed disks and are not encrypted by SSE, unless you enable encryption at host."
Option C adds a second layer of encryption at the infrastructure level for persisted OS and data disks, snapshots, and images. It is about defence in depth for data already encrypted, and it still leaves the temporary disk and caches out of scope.