A reviewer closes a lock-chamber VM encryption finding because Azure Disk Storage server-side encryption with platform-managed keys is already on. What should the security engineer explain about that baseline versus Domain 3 disk encryption options?
Select an answer to reveal the explanation.
Short Explanation
SSE-at-rest is the locked warehouse floor—always on for managed disks. Temp disks and host caches still need the extra locks: ADE, encryption at host, or confidential disk encryption.
Full Explanation
When a reviewer closes a lock-chamber VM encryption finding solely because Azure Disk Storage server-side encryption with platform-managed keys is on, the security engineer must explain that platform-managed SSE is the default at-rest protection for managed disks—not complete coverage of every Domain 3 disk encryption concern. SSE with platform-managed keys encrypts managed disk data at rest in Azure Storage, but it does not by itself encrypt temporary disks or host caches the way Azure Disk Encryption, encryption at host, or confidential disk encryption can address. Closing the finding without evaluating those additional levers understates residual risk for canal compute that writes sensitive chamber state to temp disks or host caches.
Claiming platform-managed SSE already encrypts temporary disks, host caches, and guest OS volumes—so ADE and encryption at host add no value—fails by concept: those are precisely the gaps SSE-at-rest does not automatically close. Treating SSE as identical to Azure Disk Encryption fails because ADE runs BitLocker or dm-crypt inside the guest with Key Vault integration, which is a different trust and CPU model than platform SSE. Asserting that platform-managed SSE must be turned off before confidential disk encryption can bind an OS disk to the TPM fails: confidential disk encryption is tied to confidential VM sizing and TPM binding and is not framed as “disable SSE first.”
Exam caveat: platform-managed SSE is baseline and almost always present; exam questions often ask which additional control covers temp disks, host path, guest volumes, or hypervisor-sealed OS disks. Operational check: inventory lock-chamber VMs for ADE, encryption-at-host, or confidential disk encryption where policy requires more than SSE, verify temp-disk and cache requirements against the chosen control, and keep the municipal finding open until the residual encryption gap is explicitly accepted or remediated.