An older lock-chamber virtual machine must encrypt OS and data volumes inside the guest with BitLocker or dm-crypt and store encryption secrets in Key Vault. Which control should the security engineer select?
Select an answer to reveal the explanation.
Short Explanation
ADE is the lock inside the cabin: BitLocker or dm-crypt on the guest, keys hanging in Key Vault. It costs some CPU, but that is the named guest-level option for those older chambers.
Full Explanation
Azure Disk Encryption provides guest-level encryption of OS and data volumes using BitLocker on Windows and dm-crypt on Linux, with BitLocker encryption keys (and optional key encryption keys) integrated with Azure Key Vault. Encryption at host protects data outside that guest BitLocker/dm-crypt path and is preferred for many new VMs, but it is not ADE. Confidential disk encryption requires confidential VM sizing and TPM binding. Platform SSE alone does not implement guest ADE.