Compliance requires end-to-end encryption of temporary disks, caches, and the compute-to-storage path for lock VMs without burning guest CPU on BitLocker. Which control should the security engineer enable?
Select an answer to reveal the explanation.
Short Explanation
Encryption at host is the cloak around the lock house—temp disks, caches, and the ride to storage—without running BitLocker on the guest CPU.
Full Explanation
Compliance that requires end-to-end encryption of temporary disks, caches, and the compute-to-storage path for lock VMs without burning guest CPU on BitLocker points to encryption at host. Encryption at host encrypts data on the host before it reaches Azure Storage and extends protection to temporary disks and host caches, avoiding the guest CPU cost of ADE’s BitLocker or dm-crypt. When customer-managed keys are required, pair encryption at host with a disk encryption set. For canal fleets that care about the host path and temp/cache coverage without in-guest crypto overhead, this is the control to enable.
Enabling Azure Disk Encryption on the existing OS disk and assuming temp disks and host caches are covered automatically fails by concept: ADE is guest-volume encryption and is mutually exclusive with encryption at host; it is not the host-path/temp-cache model described. Enabling confidential disk encryption on a non-confidential VM size so the hypervisor can still read the OS disk fails because confidential disk encryption requires confidential VM sizing and is about TPM-bound OS disk protection, not a workaround on ordinary sizes. Disabling server-side encryption so encryption at host becomes the only at-rest control fails because SSE remains the storage baseline; encryption at host complements it rather than requiring SSE to be turned off.
Exam caveat: ADE and encryption at host cannot both run on the same VM; encryption at host is the usual answer when temp disks, caches, and host-to-storage encryption without guest BitLocker are required. Operational check: enable encryption at host on a pilot lock VM (with a disk encryption set if CMK is mandated), confirm the platform reports host encryption enabled, verify ADE is not also configured, and validate municipal compliance evidence covers temp disks and the compute-to-storage path.