A compliance auditor asks Cascade Regional Airlines to prove that the maintenance-records VM's OS disk is encrypted at rest, and separately asks whether the guest OS volume itself is encrypted from inside the operating system with a customer-managed key exposed to the OS. What is true about these two encryption layers on a managed disk?
Select an answer to reveal the explanation.
Short Explanation
Think of it as two separate locks on the same door: one lock is built into the building and is already locked the moment the disk exists, that's server-side encryption at rest, on by default. The second lock is one the tenant installs themselves inside the unit, that's in-guest volume encryption, and it takes an extra deliberate step to enable. Auditors asking about both are really asking about two different mechanisms, not one.
Full Explanation
Azure managed disks get server-side encryption at rest by default, using platform-managed keys unless the customer supplies their own, and this protects the data as it's stored without requiring any action inside the guest OS. That's separate from in-guest volume encryption, which uses Azure Disk Encryption — BitLocker on Windows or DM-Crypt on Linux — to encrypt the OS and data volumes from within the operating system itself, and that has to be explicitly enabled; it isn't automatic. The claim that managed disks are 'never encrypted unless manually enabled' ignores that default server-side encryption at rest, which is on from the moment the disk is created. The claim that only unmanaged disks can be encrypted has it backwards — managed disks fully support both server-side encryption and Azure Disk Encryption; it's not a limitation exclusive to unmanaged storage. The claim that encrypting the OS disk automatically propagates to every existing snapshot and image is also false — snapshots and images taken before enabling additional protections don't retroactively inherit it, and each needs its own verification. As an operational check, review the disk's encryption settings in the portal to confirm both the encryption-at-rest configuration and, separately, whether Azure Disk Encryption is actually enabled inside the guest before telling an auditor both boxes are checked.