Compliance requires end-to-end encryption of temporary disks, cache…

Question

Compliance requires end-to-end encryption of temporary disks, caches, and the compute-to-storage path for lock VMs without burning guest CPU on BitLocker. Which control should the security engineer enable?

Accepted Answer

Enable encryption at host on the virtual machine, optionally with a disk encryption set when customer-managed keys are required. — Encryption at host is the cloak around the lock house—temp disks, caches, and the ride to storage—without running BitLocker on the guest CPU.

Answer

Enable Azure Disk Encryption on the existing OS disk and assume temp disks and host caches are covered automatically.

Answer

Enable confidential disk encryption on a non-confidential VM size so the hypervisor can still read the OS disk.

Answer

Disable server-side encryption so encryption at host becomes the only at-rest control.

Compliance requires end-to-end encryption of temporary disks, caches, and the compute-to-storage path for lock VMs without burning guest CPU on BitLocker. Which control should the security engineer enable?

Short Explanation

Full Explanation