A lock-controller VM must keep its OS disk sealed so the host and hypervisor cannot read it. Which approach meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
If the dockmaster’s safe must stay shut even from the pier crew, you need a confidential VM and confidential disk encryption—OS disk sealed to the TPM, not just ADE on a regular box.
Full Explanation
A lock-controller VM whose OS disk must remain sealed so the host and hypervisor cannot read it requires a confidential virtual machine size with confidential disk encryption enabled. Confidential disk encryption binds the OS disk so it stays protected from the host and hypervisor, with keys associated to the TPM. That is the civic model where the dockmaster’s safe stays shut even from the pier crew: ordinary ADE or host encryption does not cryptographically bar the hypervisor the way confidential disk encryption on a confidential VM does. Temporary-disk encryption on confidential VMs is a separate opt-in and should not be confused with the OS-disk TPM binding.
Enabling Azure Disk Encryption on a standard D-series VM and treating BitLocker as TPM-bound confidential disk encryption fails by concept: ADE on conventional sizes is guest BitLocker/dm-crypt with Key Vault, not confidential VM OS-disk sealing against the hypervisor. Enabling encryption at host alone so the hypervisor is cryptographically barred from reading the OS disk fails because encryption at host protects the host-to-storage path and temp/cache data; it does not provide the confidential-VM TPM-bound OS disk model. Turning on platform-managed SSE with a double encryption toggle and skipping confidential VM sizing fails because SSE (even with double encryption options) is still at-rest storage encryption, not confidential disk encryption.
Exam caveat: confidential disk encryption presupposes a confidential VM size; do not equate ADE BitLocker or encryption at host with hypervisor-sealed OS disks. Operational check: deploy or resize to a supported confidential VM SKU, enable confidential disk encryption for the OS disk, confirm TPM association in platform status, decide separately whether temp-disk encryption is required, and document the sealed-controller posture for municipal auditors.