A security engineer is hardening an Azure AI Search instance used in a RAG pipeline. The requirement is that data indexed by Azure AI Search must be encrypted at rest using a key that can be revoked instantly if a breach is detected. What must be configured?

C is correct because Azure AI Search supports customer-managed key (CMK) encryption where the encryption key is stored in Azure Key Vault. With soft-delete and purge protection enabled, the key cannot be accidentally permanently deleted, but access to the key can be revoked to instantly render the indexed data inaccessible, meeting the instant revocation requirement. B is incorrect because disabling soft-delete and purge protection could lead to accidental permanent key deletion with no recovery path, creating an operational risk. A is incorrect because Microsoft-managed keys cannot be revoked by the customer security team. D is incorrect because Azure AI Search is a PaaS service and Azure Disk Encryption applies to IaaS virtual machine disks.