Microsoft AZ-104 Exam - Topic 17 Question 79 Discussion

Actual exam question for Microsoft's AZ-104 exam

Question #: 79
Topic #: 17

[All AZ-104 Questions]

You have an Azure virtual machine named VM1 and an Azure key vault named Vault1.

On VM1, you plan to configure Azure Disk Encryption to use a key encryption key (KEK)

You need to prepare Vault! for Azure Disk Encryption.

Which two actions should you perform on Vault1? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

ACreate a new key.

BSelect Azure Virtual machines for deployment

CConfigure a key rotation policy.

DCreate a new secret.

ESelect Azure Disk Encryption for volume encryption

Show Suggested Answer

Suggested Answer: B, E

To prepare a key vault for Azure Disk Encryption, you need to select Azure Virtual machines for deployment and select Azure Disk Encryption for volume encryption in the key vault access policy settings. These options enable the VMs to access the keys and secrets stored in the key vault for disk encryption. Creating a new key or secret is not required, as Azure Disk Encryption can generate them automatically. Configuring a key rotation policy is optional and not related to preparing the key vault for disk encryption. Reference:

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault

https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/encrypt-disks

by Daniel at Jul 03, 2023, 07:11 PM

Limited Time Offer

25%

Off

Get Premium AZ-104 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Johanna

4 months ago

Wait, can you really just select Azure Virtual machines for deployment? Sounds off.

upvoted 0 times

...

Harris

4 months ago

Nope, you need a new key for this specific setup.

upvoted 0 times

...

Sheron

4 months ago

I thought you could just use an existing key?

upvoted 0 times

...

Nettie

4 months ago

Agree, selecting Azure Disk Encryption is a must too!

upvoted 0 times

...

Rene

4 months ago

You definitely need to create a new key for encryption.

upvoted 0 times

...

Lera

5 months ago

I’m leaning towards selecting Azure Virtual machines for deployment, but I’m not sure if that’s relevant for this specific scenario.

upvoted 0 times

...

Emile

5 months ago

I practiced a similar question, and I feel like configuring a key rotation policy might be necessary, but I’m not completely confident.

upvoted 0 times

...

Dell

5 months ago

I remember something about selecting Azure Disk Encryption for volume encryption, but I can't recall if that's the right choice here.

upvoted 0 times

...

Sharika

5 months ago

I think we need to create a new key for the key encryption key, but I'm not sure if that's the only step.

upvoted 0 times

...

My

5 months ago

No problem, I've got this. I'll just place my cursor in the "Velociraptor" list item, go to the Paragraph group, and click the "Change List Level" option to set it to Level 3.

upvoted 0 times

...

Sena

5 months ago

Okay, I've got this. System groups allow you to provision access to directories, enforce policies, and provision access to applications. I'm confident those are the right answers.

upvoted 0 times

...

Samira

5 months ago

I feel pretty confident about this. Based on the context, I think the queen was encouraged to spend money "abundantly" - option B.

upvoted 0 times

...

Ayomide Oluwaga

3 years ago

Answer is correct https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault?tabs=azure-portal#azure-portal-1

upvoted 1 times

...